`tls: failed to verify certificate: x509: certificate is valid for 192.168.0.100, 172.17.0.1, not 192.168.0.104`

[khteh]

Summary

$ k exec -it ubuntu -- bash
error: Internal error occurred: error sending request: Post "https://192.168.0.104:10250/exec/default/ubuntu/ubuntu?command=bash&input=1&output=1&tty=1": tls: failed to verify certificate: x509: certificate is valid for 192.168.0.100, 172.17.0.1, not 192.168.0.104

$ m inspect
Inspecting system
Inspecting Certificates
Inspecting services
  Service snap.microk8s.daemon-cluster-agent is running
  Service snap.microk8s.daemon-containerd is running
  Service snap.microk8s.daemon-kubelite is running
  Service snap.microk8s.daemon-k8s-dqlite is running
  Service snap.microk8s.daemon-apiserver-kicker is running
  Copy service arguments to the final report tarball
Inspecting AppArmor configuration
Gathering system information
  Copy processes list to the final report tarball
  Copy disk usage information to the final report tarball
  Copy memory usage information to the final report tarball
  Copy server uptime to the final report tarball
  Copy openSSL information to the final report tarball
  Copy snap list to the final report tarball
  Copy VM name (or none) to the final report tarball
  Copy current linux distribution to the final report tarball
  Copy asnycio usage and limits to the final report tarball
  Copy inotify max_user_instances and max_user_watches to the final report tarball
  Copy network configuration to the final report tarball
Inspecting kubernetes cluster
  Inspect kubernetes cluster
Inspecting dqlite
  Inspect dqlite
cp: cannot stat '/var/snap/microk8s/8612/var/kubernetes/backend/localnode.yaml': No such file or directory

WARNING:  Maximum number of inotify user watches is less than the recommended value of 1048576. 
	  Increase the limit with: 
	  	 echo fs.inotify.max_user_watches=1048576 | sudo tee -a /etc/sysctl.conf
	  	 sudo sysctl --system
Building the report tarball
  Report tarball is at /var/snap/microk8s/8612/inspection-report-20260131_165534.tar.gz

What Should Happen Instead?

Reproduction Steps

1. ...
2. ...

Introspection Report

inspection-report-20260131_165534.tar.gz

Can you suggest a fix?

Are you interested in contributing with a fix?

[yosuf]

Actually, the message is pretty clear. It says that the issued certificate by microk8s is only valid for the ip addresses which were probably known during installation. Your server ip has changed and it does not trust it anymore.

Read the docs how to add the nee address to your config and reissue certs. This is not an issue for here. It is clearly a support question which is not provided here.

[khteh]

Where is the doc?