GKE DNS control plane endpoint failed to verify certificate: x509

[milan-usc]

I have configured DNS endpoint for my GKE cluster, DNS endpoint is visible in the google console and it works partially. 
After enabling DNS endpoint I generated new Kubeconfig file. But that file had IP adress in server section. 
I have changed it, put DNS endpoint instead of the IP.
When I tryed to connect to the cluster with kubectl I got this error:

Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority

After that in Kubeconfig I added 

insecure-skip-tls-verify: true

And I was able to connect to the cluster.

Is this maybe bug in GKE DNS endpoint feature or I misconfigured something, any idea? 

[mokit]

Hi, @milan-usc.

When you replace the IP address with the DNS endpoint, the server’s certificate must have a Subject Alternative Name (SAN) entry for the DNS name you're using. If it doesn't, then you'll get the similar types of error.

Rather then replacing the IP address with DNS, regenerate the kubeconfig using gcloud. Run gcloud container clusters get-credentials <cluster-name> --zone <zone> --project <project>.

Regards,
Mokit

[garisingh · Accepted solution]

You actually need to get the credentials for the DNS endpoint if you also have the IP endpoint enabled:

gcloud container clusters get-credentials CLUSTER_NAME \
    --dns-endpoint --location LOCATION

[milan-usc]

This is exactly what worked in the end.

I had older version of gcloud CLI and that version did not have --dns-endpoint flag.

After updating gcloud I have generated new kubeconfig with --dns-endpoint and everything worked without any need to modify kubeconfig.

[mababio]

I think I'm experiencing similar issue, but solution in this post didn't resolve things.

this my k8s terraform provider:

provider "kubernetes" {
  host                   = var.k8s_host
  token                  = var.k8s_token
  cluster_ca_certificate = base64decode(var.k8s_cluster_ca_certificate)
}

everything works when using defaulted  k8s control panel public endpoint. I disable that and enable GKE DNS endpoint. I now I'm getting 

Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority

I deleted my .kube/config file to start fresh and ran the get credential command. config was recreated with no certificate-authority-data.  

I'm thinking this DNS endpoint feature is  fairly new and things like this will be fixed for us all. Yes I could probably create a new cluster, but I don't want to at this point.