TKGI Management Console reports "Failed to retrieve current TKGI Instance clusters. cannot get TKGI client: cannot login into TKGI: Post https://<IP-ADDRESS>:8443/oauth/token: x509: certificate has expired or is not yet valid"

Products

• VMware Tanzu Kubernetes Grid Integrated (TKGi)

Issue/Introduction

To provide the steps for rotating the TKGI API certificate when using the TKGI Management Console

Symptoms:

When logged in to the TKGI Management Console and viewing the Clusters tab, you see the following error on the UI:

Failed to retrieve current TKGI Instance clusters. cannot get TKGI client: cannot login into TKGI: Post https://<IP-ADDRESS>:8443/oauth/token: x509: certificate has expired or is not yet valid

 

 

Environment

VMware Tanzu Kubernetes Grid Integrated Edition 1.x

Cause

Certificate is expired

Resolution

Perform the following steps to rotate the TKGI API cert in the Management Console:

If this is a custom cert, that cert will need to be regenerated by the customer.
Once regenerated:

1. Login to Opsmanager -> TKGI Tile
2. Go to the TKGI API Tab
3. Click Change
4. Paste the custom cert and key into the correct fields
5. Click Save at the bottom of the page

If this is a self-signed cert by the Opsmanager:

1. Login to Opsmanager -> TKGI Tile
2. Go to the TKGI API Tab
3. Copy the TKGI API FQDN for use to regenerate the cert
4. Click Change
5. Click Generate RSA Certificate
6. Paste the TKGI API FQDN into the field
7. Click Generate
8. Copy new CERT and put into a text file for use in the MC
9. Copy new KEY and put into a text file for use in the MC
10. Click Save at the bottom of the page

After populating the TKGI Tile -> TKGI API tab in Opsmanager above, complete the process in TKGI Management Console:
 

1. Login to the TKGI MC
2. Go to TKGI CONFIGURATION Tab
3. Select the cert box toward the bottom, which will present two boxes to enter the new data in
4. Paste the CERT into the correct box
5. Paste the KEY into the correct box
6. Save the configuration
7. Apply Changes

 

 

Additional Information

There is a case where the applied changes have been completed on the Opsman UI and the private key is not visible under UI. 

The public/private key can be found under the pivotal-container-serviceVM

:/var/vcap/jobs/pks-api/config# cat /var/vcap/jobs/uaa/config/uaa.crt

-----BEGIN CERTIFICATE-----
MIIDojCCAoqgAwIBAgIVAI38Ze9ql2NWs8JikaVx2D5TTN85MA0GCSqGSIb3DQEB

....

-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAyRgHJ9ZCq4C2UEEb5sIoXodx2vVwuKymmhFW8tl4mhLbXLp5

....

-----END RSA PRIVATE KEY-----

Use the above cert and key to update the Management console with the public and private keys