dashboard: Error 500: The server asked for credentials

Hello,

I’m trying to test the dashboard but i get the following errors and i can’t access to the UI

2016/02/14 15:46:15 Getting list of all replication controllers in the cluster
2016/02/14 15:46:15 the server has asked for the client to provide credentials (get replicationControllers)
2016/02/14 15:46:15 Outcoming response to 62.210.220.xx:56978 with 500 status code

Could you please guide me to solve this issue ?

Regards, Smana

About this issue

Original URL
State: closed
Created 8 years ago
Comments: 70 (29 by maintainers)

Commits related to this issue

Merge pull request #23550 from luxas/fix_hyperkube_certs Automatic merge from submit-queue Fix so setup-files don't recreate/invalidate certificates that already exist Fixes: #23197 and a lot of ot... — committed to kubernetes/kubernetes by k8s-github-robot 8 years ago
Merge pull request #374 from anvithks/fix373-envsubst [Fixes #373] Fixed envsubst not working on Ubuntu18.04/CentOS8 on VirtualBox — committed to anvithks/k8s-dashboard by skdwriting 4 years ago

Most upvoted comments

For me it was the same issue here’s how i fixed it (like above):

First get the secrets from the right namespace

$ kubectl get secrets --namespace=kube-system

NAME                  TYPE                                  DATA      AGE
default-token-7ovhb   kubernetes.io/service-account-token   3         7m

Delete the default-token from the kube-system namespace

$ kubectl delete secret default-token-7ovhb --namespace=kube-system

Delete the replication controller from the dashboard $ kubectl delete rc kubernetes-dashboard-v0.1.0 --namespace=kube-system

Recreate the dashboard $ kubectl create -f dashboard-controller.yaml

Enjoy!

+28

innovia on Mar 17, 2016

One should always check that the default tokens generated by Kubernetes are actually valid, especially after a new cluster installation or Kubernetes update.

One easy way to do so:

$ DEFAULT_TOKEN=$(kubectl --namespace=kube-system get serviceaccount default -o jsonpath="{.secrets[0].name}")
$ TOKEN_VALUE=$(kubectl --namespace=kube-system get secret "$DEFAULT_TOKEN" -o go-template="{{.data.token}}" | base64 -d)
$ curl -k -H "Authorization: Bearer $TOKEN_VALUE" https://my-api-server:6443/version
# should return API server version

antoineco on Mar 17, 2016

Sure! @theobolo Try this: Append

--admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota

to kube-apiserver.service Append

--service-account-private-key-file=/var/run/kubernetes/apiserver.key --root-ca-file=/var/run/kubernetes/apiserver.crt

to kube-controller-manager.service This will probably fix your issue. (BTW, I haven’t used k8s on azure, but read the source now, and this will probably help)

The two issues are different, @theobolo´s is that serviceAccounts aren’t created for the default namespace for connecting to apiserver. The controller-manager code above fixes that. Then there’s a ServiceAccountController too, and you have to enable that one also. It takes a normal pod, and injects the ca.crt and token files into /var/run/secrets/kubernetes.io/serviceaccount/

luxas on Feb 23, 2016

You can use kubeconfig files with 1.1.0-beta2 version or 1.1 (to be released in 2 weeks). All you need to do is to specify KUBECONFIG env var and point it to the file.

bryk on Jun 15, 2016

Is there an ENV variable that i can use in the replication controller to change the requesting URL ? I want to target https://172.18.0.12:8443/ wich is working on my cluster from any nodes and any pods.

Use --apiserver-port argument for the container in your YAML file. This will fix the problem

bryk on Feb 24, 2016