tls: server selected unsupported protocol version 301

0
votes

I have local kubernetes cluster on vm. I use containerd as a CRI. and when i install calico, have the next error with calico-kube-controllers

"Warning FailedCreatePodSandBox 2m41s (x638 over 140m) kubelet, serverhostname (combined from similar events): Failed to create pod sandbox: rpc error: code = Unknown desc = failed to setup network for sandbox "a46b6b0c52c2adec7749fff781401e481ca911a198e0406d7fa646c6d5d5e781": error getting ClusterInformation: Get https://[10.96.0.1]:443/apis/crd.projectcalico.org/v1/clusterinformations/default: tls: server selected unsupported protocol version 301"

P.S with docker as a CRI, works fine

OS version Red Hat Enterprise Linux Server release 7.7 (Maipo)

Openssl version OpenSSL 1.1.1 11 Sep 2018

Configuring tls-min-version for kubelet and kube-api-server didn't help.

1
sslkubernetescontainerd
How did you bootstrap your cluster? Kubeadm? Can you provide kubectl logs and describe of this failing calico controller pod? – acid_fuji
How are you installing calico? – Arghya Sadhu
"301" is probably {3, 1} which means TLS 1.0 (SSL3 is {3, 0}, TLS 1.1 is {3, 2}). As is, it just means one party is not using TLS 1.0 anymore, which is good. Worldwide movement is going towards completely obsoleting TLS 1.0 and 1.1 to leave only 1.2 or preferably 1.3 that is brand new. – Patrick Mevzek
1) can't provide logs cause pod is not running. yes, i bootstrap my cluster with kubeadm. 2) calico was installed with the following command "kubectl apply -f docs.projectcalico.org/manifests/calico.yaml" 3)i try to confuge kubelet and kube-api server to use min-tls-version 1.3, and it did not help – MAGuire

1 Answers

1
votes

solve the promlem. my cluster works behind corp proxy, and containerd sent requests to 10.96.0.1 through the proxy. i just add IP 10.96.0.1 to non proxy list to containerd proxy conf.