Approving certificate signing requests (csr) for OpenShift
Sometimes entry into the shell of an OpenShift container returns an error message like
Error from server: error dialing backend: x509: certificate is valid...
This error message is due to pending certificate signing requests (csr) approval or expired certificate signing requests (csr). Complete the following steps to approve certificate signing requests (csr). You can also refer to OpenShift documentation to know about csr.
-
Ensure that entry into the shell returns an error on all pods of the node.
-
Run the following command to check for pending approvals.
oc get csr
-
Run the following command to approve pending csrs.
oc get csr -o go-template='{% raw %}{{range .items}}{% endraw %}{% raw %}{{if not .status}}{% endraw %}{% raw %}{{.metadata.name}}{% endraw %}{% raw %}{{"\\n"}}{% endraw %}{% raw %}{{end}}{% endraw %}{% raw %}{{end}}{% endraw %}' | xargs oc adm certificate approve
-
Try entry into the shell to ensure that it is unblocked.
Related information