all knative pods are in 'CrashLoopBackOff' with "Failed to get k8s version" error about serving

[skonto]

Hi @snailshadow what is the output if you run:

kubectl -it exec <activator> -- curl -v -k https://<api-server>:443/version?timeout=32s
kubectl -it exec <activator> -- curl -v --header "Authorization..." --cacert <path to sa> https://<api-server>:443/version?timeout=32s

[snailshadow]

@skonto pod is not ready , so I am unable to run these two commands to verify the certificate of k8s api-server

[skonto]

Activator should be no different it uses the K8s sa crt and token. Do you use a custom activator image or an upstream release? Another possible reason you see this is that certificates are not setup correctly for some reason on your cluster, what happens if you rotate them (https://learn.microsoft.com/en-us/azure/aks/certificate-rotation)? Do you see any difference when you run the nginx pod in the knative-serving ns?

pod is not ready , so I am unable to run these two commands to verify the certificate of k8s api-server

One option would be to modify the activator image to run the commands when it starts or try a PostStart hook (might run after the entrypoint).

[dprotaso]

/triage needs-user-input