openshift-cli skip the old request to bypass the certificate

[RH-csaggin]

https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/openshift-cli.rb

Since I updated to the lasted version (from openshift-clients-4.6.0-202006250705.p0) when I attempt to login into a cluster I do not have the question anymore to trust or not the clusters I.E.:

Server [https://localhost:8443]: https://openshift.example.com:6443 
The server uses a certificate signed by an unknown authority.
You can bypass the certificate check, but any data you send to the server could be intercepted by others.
Use insecure connections? (y/n): y 

but it goes directly on: error: x509: “kube-apiserver-lb-signer” certificate is not trusted

Only adding the flag --insecure-skip-tls-verify=true allow me to connect which is more painful than just replying to the interacting question.

I can confirm that this is a bug present on openshift-clients-4.12.0-202208031327 as when I downgrade the package version to the previous 4.6.0 it when back to work as expected.

[vlours]

Hi @RH-csaggin,

BZ 2097830: Regression: OC cli 4.11 (macOS) is still facing issues trusting the ingress TLS certificate, even the options --insecure-skip-tls-verify or --certificate-authority the CLI is not working. (OCPBUGS-1667)
Related solution: KCS 6977569

Hope this helps.

[ryannix123]

Just FYI, running, oc login --insecure-skip-tls-verify=true --token=sha256~Gy7ohfOAcTlvBAKb4_VTQH337a0raXwcO3uVC1xoYJI --server=https://api.crc.testing:6443 worked for me, and my laptop is running macOS 13.0.1 (22A400)

[Siddhartha082]

how did you generated Tokens??

[vlours]

@ryannix123 which version of the CLI are you using?
Running with the version 4.11.13, still, fails for me:

$ oc-4.11.13 login --insecure-skip-tls-verify=true -u kubeadmin api.<domain>:6443
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

Running on macOS 12.6.1

$ uname -a
Darwin vlours-mac 21.6.0 Darwin Kernel Version 21.6.0: Thu Sep 29 20:12:57 PDT 2022; root:xnu-8020.240.7~1/RELEASE_X86_64 x86_64

[ryannix123]

4.8.11

[ryannix123]

I upgraded my client version using homebrew, so now I'm at Client Version: 4.12.0-202208031327, and I see the bug with oc.

oc login --insecure-skip-tls-verify=true -u kubeadmin -p 7QAvE-4Bima-Eg3j4-3ijS9 https://api.crc.testing:6443
WARNING: Using insecure TLS client config. Setting this option is not supported!
Unable to connect to the server: read tcp [::1]:54657->[::1]:443: read: connection reset by peer

[RH-csaggin]

Just to clarify this bug is not about if the client can connect or not, but that newer versions miss the interactive "bypass the certificate check" question.

[cniackz]

I was facing similar issue:

$ oc login -u kubeadmin https://api.crc.testing:6443
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

$ oc login -u developer https://api.crc.testing:6443
error: x509: “kube-apiserver-lb-signer” certificate is not trusted

My MacBook Pro is:

$ uname -a
Darwin Cesars-MacBook-Pro.local 22.5.0 Darwin Kernel Version 22.5.0: Thu Jun  8 22:22:20 PDT 2023; root:xnu-8796.121.3~7/RELEASE_ARM64_T6000 arm64

I was able to login like this:

$ oc login --insecure-skip-tls-verify=true -u kubeadmin -p CyUrJ-ggmnD-w8rUU-BHJoj https://api.crc.testing:6443
WARNING: Using insecure TLS client config. Setting this option is not supported!

Login successful.

You have access to 65 projects, the list has been suppressed. You can list all projects with 'oc projects'

Using project "default".

[RH-csaggin]

The issue has been fixed on openshift cli 4.14 the problem came from the error type changes in Go as fixed in openshift/oc#1406