TLS handshake timeout with kubernetes in GKE

问题

I've created a cluster on Google Kubernetes Engine (previously Google Container Engine) and installed the Google Cloud SDK and the Kubernetes tools with it on my Windows machine.

It worked well for some time, and, out of nowhere, it stopped working. Every command I'm issuing with kubectl provokes the following:

Unable to connect to the server: net/http: TLS handshake timeout

I've searched Google, the Kubernetes Github Issues, Stack Overflow, Server Fault ... without success.

I've tried the following:

• Restart my computer
• Change wifi connection
• Check that I'm not somehow using a proxy
• Delete and re-create my cluster
• Uninstall the Google Cloud SDK (and kubectl) from my machine and re-install them
• Delete my .kube folder (config and cache)
• Check my .kube/config
• Change my cluster's version (tried 1.8.3-gke.0 and 1.7.8-gke.0)
• Retry several hours later
• Tried both on PowerShell and cmd.exe

Note that the cluster seem to work perfectly, since I have my application running on it and can interact with it normally through the Google Cloud Shell.

Running:

gcloud container clusters get-credentials cluster-2 --zone europe-west1-b --project ___

kubectl get pods

works on Google Cloud Shell and provokes the TLS handshake timeout on my machine.

回答1:

For others seeing this issue, there is another cause to consider.

After doing:

gcloud config set project $PROJECT_NAME
gcloud config set container/cluster $CLUSTER_NAME
gcloud config set compute/zone europe-west2
gcloud beta container clusters get-credentials $CLUSTER_NAME --region europe-west2 --project $PROJECT_NAME

I was then seeing:

kubectl cluster-info
Unable to connect to the server: net/http: TLS handshake timeout

I tried everything suggested here and elsewhere. When the above worked without issue from my home desktop, I discovered that shared workspace wifi was disrupting TLS/VPNs to control the internet access!

回答2:

This is what I did to solve the above problem. I simply ran the following commands::

> gcloud container clusters get-credentials {cluster_name} --zone {zone_name} --project {project_name}

> gcloud auth application-default login

Replace the placeholders appropriately.

回答3:

So this MAY NOT work for you on GKE, but Azure AKS (managed Kubernetes) has a similar problem with the same error message so who knows — this might be helpful to someone.

The solution to this for me was to scale the nodes in my Cluster from the Azure Kubernetes service blade web console.

Workaround / Solution

1. Log into the Azure (or GKE) Console — Kubernetes Service UI.
2. Scale your cluster up by 1 node.
3. Wait for scale to complete and attempt to connect (you should be able to).
4. Scale your cluster back down to the normal size to avoid cost increases.

Total time it took me ~2 mins.

More Background Info on the Issue

Added this to the full ticket description write up that I posted over here (if you want more info have a read):

'Unable to connect Net/http: TLS handshake timeout' — Why can't Kubectl connect to Azure AKS server?

来源：https://stackoverflow.com/questions/47481022/tls-handshake-timeout-with-kubernetes-in-gke