topic Re: Did someone encounter this problem when integrating with Openshift 4.2 with TLS Certificate? in Container platforms

Did someone encounter this problem when integrating with Openshift 4.2 with TLS Certificate?

jcorreaalvarez — Tue, 07 Apr 2020 21:17:11 GMT

Hello some one had problems integrating Dynatrace with Openshift 4.2 with TLS errors. Presenting this the following message in UI and logs,

The integration work Ok with API Token and Bearer Token ,without Certification enable.

When try to enable this is observed Red Error and this entry on log

2020-04-01 13:38:38 UTC INFO [<tenant> ] [KubernetesFastCheck] Fast check failed for endpoint https://api.xxx..xxx.com:443/api with SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target [Suppressing further identical messages for 3600000 ms]

Apparently the OCP side certificate (.pem) does not present API URI.

Has anyone working this integration with Certificate OK ? Thank you!

Re: Did someone encounter this problem when integrating with Openshift 4.2 with TLS Certificate?

DanielS — Wed, 08 Apr 2020 20:17:39 GMT

Certificate management for Cloud Foundry, Kubernetes, and OpenShift communication

Jorge please check this https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-activegate/configuration/set-up-proxy-authentication-for-activegate/#anchor_certificate

The bearer token is invalid and the request has been rejected by the Kubernetes API. Verify the bearer token. Make sure it doesn't contain any whitespaces. If you're connecting to a Kubernetes cluster API via a centralized external role-based access control (RBAC) consult the documentation of the Kubernetes cluster manager.

Re: Did someone encounter this problem when integrating with Openshift 4.2 with TLS Certificate?

jcorreaalvarez — Wed, 15 Apr 2020 19:16:25 GMT

Thanks Daniel this configuration was used from beginning but the trouble detected is into

.PEM generated from OCP Cluster .

echo Q | openssl s_client -connect google.com:443 | openssl x509 -outform PEM > dt_k8s_api.pem

This may be not deliver CN and SAM fields with information valid (API hostname and IP ),only seen DNS IP..

My questions if only is somebody has same difficult.

Thanks in advance

Jorge