Authentication handshake failed during okteto build

Okteto Self-Hosted
1

I’m getting this error “all of a sudden” :slight_smile: I’m sure I misconfigured something. but… the SSL certificate for https://registry.dev.upshift.earth doesn’t seem cranky…

It’s preventing me from building with okteto :frowning:

Error building service 'fuji-service': error building image 'registry.dev.upshift.earth/bennidhamma/fuji-service-fuji-service:okteto': build failed: failed to get status: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: EOF"

Any suggestions?

2

hrmmm… looks like okteto-buldkit can’t get scheduled:

Name:             okteto-buildkit-e142dcd56f-0
Namespace:        okteto
Priority:         0
Service Account:  default
Node:             <none>
Labels:           app.kubernetes.io/component=buildkit
                  app.kubernetes.io/instance=okteto
                  app.kubernetes.io/name=okteto-buildkit-e142dcd56f
                  app.kubernetes.io/part-of=okteto
                  controller-revision-hash=okteto-buildkit-e142dcd56f-76d4559df8
                  statefulset.kubernetes.io/pod-name=okteto-buildkit-e142dcd56f-0
Annotations:      kubernetes.io/psp: eks.privileged
Status:           Pending
IP:               
IPs:              <none>
Controlled By:    StatefulSet/okteto-buildkit-e142dcd56f
Containers:
  buildkitd:
    Image:      okteto/buildkit:v0.10.3-okteto2
    Port:       1234/TCP
    Host Port:  0/TCP
    Command:
      /usr/bin/start.sh
    Limits:
      memory:  12Gi
    Requests:
      cpu:     1
      memory:  4Gi
    Environment:
      OKTETO_BUILDKITD_LOCAL_URL:  local-buildkitd.dev.upshift.earth
      OKTETO_INGRESS_INTERNAL_IP:  $(OKTETO_INGRESS_NGINX_CONTROLLER_SERVICE_HOST)

      STORAGE:                     500000
    Mounts:
      /run/secrets/tls from tls-certs (ro)
      /var/lib/buildkit from storage (rw,path="data")
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-b6pk2 (ro)
Conditions:ate-secret
    Optional:    false
  kube-api-access-b6pk2:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   Burstable
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
  Type           Status
  PodScheduled   False 
Volumes:
  storage:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  storage-okteto-buildkit-e142dcd56f-0
    ReadOnly:   false
  tls-certs:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  upshift-certificate-secret
    Optional:    false
  kube-api-access-b6pk2:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   Burstable
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason            Age   From               Message
  ----     ------            ----  ----               -------
  Warning  FailedScheduling  35s   default-scheduler  0/3 nodes are available: 3 node(s) had volume node affinity conflict.
3

OK, this answer got me through.

1 Like
4

Hey @benjoldersma! interesting. Which of the solutions proposed on the stackoverflow post helped you out? (I’m assuming you are in EKS?)

5

The 4 step answer by jonashackt. Basically, that I needed to configure my storage class with an allowed topologies directive that was compatible with my nodes.

allowedTopologies:
- matchLabelExpressions:
  - key: failure-domain.beta.kubernetes.io/zone
    values:
    - us-west-2c

:slight_smile:

1 Like
6

and yes, we’re on EKS!