events.action: opened
events.author: vvkkhjt
events.masked_author: username_0
events.text: **RKE version:**
  0.2.2
  **Docker version: (`docker version`,`docker info` preferred)**
  18.03.0-ce
  **Operating system and kernel: (`cat /etc/os-release`, `uname -r` preferred)**
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:centos:centos:7"
  HOME_URL="https://www.centos.org/"
  BUG_REPORT_URL="https://bugs.centos.org/"
  
  CENTOS_MANTISBT_PROJECT="CentOS-7"
  CENTOS_MANTISBT_PROJECT_VERSION="7"
  REDHAT_SUPPORT_PRODUCT="centos"
  REDHAT_SUPPORT_PRODUCT_VERSION="7"
  **Type/provider of hosts: (VirtualBox/Bare-metal/AWS/GCE/DO)**
  Bare-metal
  **cluster.yml file:**
  ```yaml
  # If you intened to deploy Kubernetes in an air-gapped environment,
  # please consult the documentation on how to configure custom RKE images.
  nodes:
  - address: 192.168.20.121
    port: "22"
    internal_address: 192.168.20.121
    role:
    - controlplane
    - worker
    - etcd
    hostname_override: rancher121
    user: rketest
    docker_socket: /var/run/docker.sock
    ssh_key: ""
    ssh_key_path: ~/.ssh/id_rsa
    labels: {}
  - address: 192.168.20.77
    port: "22"
    internal_address: 192.168.20.77
    role:
    - worker
    hostname_override: rancher77
    user: rketest
    docker_socket: /run/docker.sock
    ssh_key: ""
    ssh_key_path: ~/.ssh/id_rsa
    labels: {}
  - address: 192.168.2.193
    port: "22"
    internal_address: 192.168.2.193
    role:
    - worker
    hostname_override: rancher193
    user: rketest
    docker_socket: /run/docker.sock
    ssh_key: ""
    ssh_key_path: ~/.ssh/id_rsa
    labels: {}
  - address: 192.168.220.50
    port: "22"
    internal_address: 192.168.220.50
    role:
    - worker
    hostname_override: rancher50
    user: rketest
    docker_socket: /run/docker.sock
    ssh_key: ""
    ssh_key_path: ~/.ssh/id_rsa
    labels: {}
  services:
    etcd:
      image: ""
      extra_args: {}
      extra_binds: []
      extra_env: []
      external_urls: []
      ca_cert: ""
      cert: ""
      key: ""
      path: ""
      snapshot: false
      retention: ""
      creation: ""
      #backup_config:
      #  interval_hours: 12
      #  retention: 6
      #  s3backupconfig:
      #    access_key: 6227KC1ZC4EUGMM2PLGZ
      #    secret_key: jPS+U6GlV1wY4P9JATACS52T2dIQPEmHZ+WDxIXh
      #    bucket_name: k8setcd
      #    region: ""
      #    endpoint: http://minio.digi-sky.com:9000
    kube-api:
    nginx_proxy: rancher/rke-tools:v0.1.13
    cert_downloader: rancher/rke-tools:v0.1.13
    kubernetes_services_sidecar: rancher/rke-tools:v0.1.13
    kubedns: rancher/k8s-dns-kube-dns-amd64:1.14.10
    dnsmasq: rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.10
    kubedns_sidecar: rancher/k8s-dns-sidecar-amd64:1.14.10
    kubedns_autoscaler: rancher/cluster-proportional-autoscaler-amd64:1.0.0
    kubernetes: rancher/hyperkube:v1.11.1-rancher1
    flannel: rancher/coreos-flannel:v0.9.1
    flannel_cni: rancher/coreos-flannel-cni:v0.2.0
    calico_node: rancher/calico-node:v3.1.1
    calico_cni: rancher/calico-cni:v3.1.1
    calico_controllers: ""
    calico_ctl: rancher/calico-ctl:v2.0.0
    canal_node: rancher/calico-node:v3.1.1
    canal_cni: rancher/calico-cni:v3.1.1
    canal_flannel: rancher/coreos-flannel:v0.9.1
    wave_node: weaveworks/weave-kube:2.1.2
    weave_cni: weaveworks/weave-npc:2.1.2
    pod_infra_container: rancher/pause-amd64:3.1
    ingress: rancher/nginx-ingress-controller:0.16.2-rancher1
    ingress_backend: rancher/nginx-ingress-controller-defaultbackend:1.4
    metrics_server: rancher/metrics-server-amd64:v0.2.1
  ssh_key_path: ~/.ssh/id_rsa
  ssh_agent_auth: false
  authorization:
    mode: rbac
    options: {}
  ignore_docker_version: true
  kubernetes_version: ""
  private_registries: []
  ingress:
    provider: ""
    options: {}
    node_selector: {}
    extra_args: {}
  cluster_name: ""
  cloud_provider:
    name: ""
  prefix_path: ""
  addon_job_timeout: 0
  bastion_host:
    address: ""
    port: ""
    user: ""
    ssh_key: ""
    ssh_key_path: ""
  monitoring:
    provider: ""
    options: {}
  ```
  **Steps to Reproduce:**
  1,cluster cert is expire
  2,use rke0.2.2 rotate cert
  3,restart node
  4,cluster is fine,but api-server log has those error log
  **Results:**
  ```bash
  I1108 04:18:54.522728       1 logs.go:49] http: TLS handshake error from 192.168.20.77:36946: EOF
  I1108 04:18:54.975992       1 logs.go:49] http: TLS handshake error from 127.0.0.1:49140: EOF
  I1108 04:18:55.688478       1 logs.go:49] http: TLS handshake error from 192.168.2.253:42702: EOF
  I1108 04:18:55.881587       1 logs.go:49] http: TLS handshake error from 192.168.20.77:36980: EOF
  I1108 04:18:55.893539       1 logs.go:49] http: TLS handshake error from 192.168.2.253:42604: EOF
  I1108 04:18:57.358746       1 logs.go:49] http: TLS handshake error from 192.168.220.50:33830: EOF
  I1108 04:18:57.579623       1 logs.go:49] http: TLS handshake error from 192.168.220.50:33824: EOF
  I1108 04:18:58.701217       1 logs.go:49] http: TLS handshake error from 10.42.0.224:49746: EOF
  I1108 04:18:59.061299       1 logs.go:49] http: TLS handshake error from 192.168.2.253:42646: EOF
  I1108 04:18:59.934138       1 controller.go:105] OpenAPI AggregationController: Processing item v1beta1.metrics.k8s.io
  E1108 04:18:59.971130       1 controller.go:111] loading OpenAPI spec for "v1beta1.metrics.k8s.io" failed with: OpenAPI spec does not exists
  I1108 04:18:59.971180       1 controller.go:119] OpenAPI AggregationController: action for item v1beta1.metrics.k8s.io: Rate Limited Requeue.
  E1108 04:19:00.086635       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.088799       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.091591       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.093609       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.095432       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.097300       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.103310       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.106256       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.117610       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  E1108 04:19:00.118393       1 authentication.go:62] Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
  ```
events.title: Unable to authenticate the request due to an error: [x509: certificate has expired or is not yet valid, x509: certificate has expired or is not yet valid]
events.type: issue
events.action: closed
events.author: vvkkhjt
events.masked_author: username_0
events.type: issue