Skip to content

[Bug]: k8s kube-apiserver fails to start after container restart due to missing /kind/kubeadm.conf #2410

Open

Description

@yafeng-Soong

I have done the following

  • I have searched the existing issues
  • If possible, I've reproduced the issue using the 'main' branch of this project

Steps to reproduce

  1. Create a Kubernetes cluster:
    container k8s create --name test-k8s
  2. Verify that the cluster is healthy and kubectl responds normally:
    kubectl get nodes
  3. Restart the container (or reboot/sleep macOS), causing the container IP to change:
    container stop test-k8s
    container start test-k8s
  4. Run any kubectl command:
    kubectl get nodes
  5. kubectl permanently hangs and times out:
    Get "https://127.0.0.1:6445/api?timeout=32s": context deadline exceeded - read: connection reset by peer
    

Problem description

What happened

When a kindest/node container created by container k8s create is restarted and gets a new IP, kube-apiserver enters a CrashLoopBackOff and the API server never recovers.

Root cause

The underlying kindest/node image has an entrypoint (/usr/local/bin/entrypoint) that detects IP changes and invokes fix_certificate().
This function removes /etc/kubernetes/pki/apiserver.{crt,key} and attempts to re-generate the serving certificates using:

kubeadm init phase certs apiserver --config /kind/kubeadm.conf

However, Apple's container k8s create writes the kubeadm configuration solely to /etc/kubernetes/kubeadm-config.yaml and does not provide /kind/kubeadm.conf.
As a result:

  1. fix_certificate() fails with open /kind/kubeadm.conf: no such file or directory.
  2. The existing apiserver certificates have already been deleted.
  3. kube-apiserver crashes due to missing certificates, causing kubectl commands to hang indefinitely.

Expected behavior

The control plane node should provide /kind/kubeadm.conf (e.g. symlinked to /etc/kubernetes/kubeadm-config.yaml) so that the kind entrypoint can successfully regenerate certificates upon reboot.

Fix submitted in PR: #2344

Environment

  • OS: macOS 27.0.1 (26A434)
  • Xcode: Xcode 26.3 (17C529)
  • Container: Container CLI version 1.5.0

Code of Conduct

  • I agree to follow this project's Code of Conduct

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions