Kubernetes: Troubleshooting TLS Handshake Timeout on 'kubectl get pods'

Based on the error message ("Unable to connect to the server: net/http: TLS handshake timeout"), it appears that kubectl isn’t able to establish a secure connection with the API server. Although you resolved the earlier image pull secret issue ("ErrImageNeverPull"), the TLS handshake timeout indicates a different problem related to cluster connectivity or TLS certificate validity.

Steps to Troubleshoot

1. Verify Cluster Connectivity
   Ensure that your network can reach the Kubernetes API server. You may try to:

   • Ping the API server hostname/IP.
   • Telnet or curl the API server’s port (usually 443) to see if the connection is possible.

2. Check the TLS Certificates in Your Kubeconfig
   The API server uses HTTPS by default. Problems with certificate expiry or mismatched certificate authorities may cause handshake failures. You can inspect the certificates stored in your kubeconfig file using the following commands:

   • Check the CA Certificate:

     SHELLCopied
     kubectl config view --flatten --output 'jsonpath={.clusters[0].cluster.certificate-authority-data}' | base64 -d | openssl x509 -noout -dates

     This will output the validity period of the certificate authority certificate.

   • Check the Client Certificate:

     SHELLCopied
     kubectl config view --flatten --output 'jsonpath={.users[0].user.client-certificate-data}' | base64 -d | openssl x509 -noout -dates

     This will show the validity dates for the client certificate.

   Review the output to ensure that the certificates are still valid. If they have expired or if the chain of trust is broken, you may need to regenerate or update them.

3. Verify Your Kubeconfig File
   Double-check the kubeconfig file (typically at ~/.kube/config) for any misconfigurations:

   • Confirm the server address is correct.
   • Ensure that the certificate data is not corrupted and matches what was issued by your cluster.
   • If you recently switched contexts or clusters, confirm you are using the right settings.

4. Consider Network or API Server Issues
   If the certificates are valid and the kubeconfig file appears correctly configured, the TLS handshake timeout might be due to:

   • Network latency or firewalls blocking the connection.
   • The API server being overloaded or temporarily unreachable.
   • Misconfigured API server endpoints.

By following these steps, you should be able to narrow down whether the problem is certificate-related or due to network connectivity issues. Remember that even though the initial image pull problem was resolved, TLS and connectivity issues need to be separately addressed to re-establish a reliable connection with the cluster.