🐛 MCP error -32603: Tool execution failed: Error: self-signed certificate in certificate chain: Local Rancher K3S cluster #91
Comments
marcellodesales
changed the title
|
When running the server, can you try using |
🔧 Bypass TLS from @kubernetes/client
"kubernetes": {
"env": {
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
},
"command": "npx",
"args": ["mcp-server-kubernetes"]
}🔴 Failed with HTTP request failed{}
Error executing code: MCP error -32603: MCP error -32603: Tool execution failed: HttpError: HTTP request failed |
🔧 Bypass TLS from kubeconfig.yaml
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzTkRNd01UWTRNamN3SGhjTk1qVXdNekkyTVRreU1ESTNXaGNOTXpVd016STBNVGt5TURJMwpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzTkRNd01UWTRNamN3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUekFDZ1d2dUNHRDFxd0hLMVRwdnVLSEhzS2VwSEF4ZDIraUVURXVGZFoKTWtHR0VkRElEU2dwbTE0QXB4L1RnRkI0eG50QzMwUkVtZS9FdVpHNWpXUmlvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVThrZmJxMlhGMmlJZHJFWk0ydVIzClVZQ2hlZDR3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnYVhTQzhPRUJMVUgzUEorR2RzT0djRG1zWnRtM3Z3d0oKQWxFZlB0elNIZUFDSVFDVUN1UEd6Mm16TDZSUlVuK2w3djdDU2RjNzQ1RCtsN09vM2dJVzM1aElOQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
insecure-skip-tls-verify: true
server: https://127.0.0.1:6443
name: default
contexts:
- context:
cluster: default
user: default
name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
user:
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRlZ0F3SUJBZ0lJS0prQ2ZTa2I1VWd3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOelF6TURFMk9ESTNNQjRYRFRJMU1ETXlOakU1TWpBeU4xb1hEVEkyTURNeQpOakU1TWpBeU4xb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJQbFpTaFFJaTdIS3VHZ0kKTmtoS1RSVURjMVpYak5SQkxXMU9ZS2tuOEptY0NLbXM1L2Y1dDhNOHcvVjZXOHAzYW1TeEJBZGVzT0dUdG1yLwo5M0QrOFBHalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCUUl1NC9GMTZ2ckN1aUFMb2ZOKy9FSTVwZC9uREFLQmdncWhrak9QUVFEQWdOSUFEQkYKQWlFQTNudTREU2dnOXBJWWZsUlZGZktxSzQxWGVPMmVIS1A2Y05mK0xhS004b3dDSUVLQzUvN0doL0cvemlpUQprd3g2ZXpMRGIybU52cU9xbHAxaUpnL01DWWllCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdFkyeHAKWlc1MExXTmhRREUzTkRNd01UWTRNamN3SGhjTk1qVXdNekkyTVRreU1ESTNXaGNOTXpVd016STBNVGt5TURJMwpXakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwWlc1MExXTmhRREUzTkRNd01UWTRNamN3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFSZzlzY28va0F2YW9wWFB0MEcxaCtSQTZ6azNPY1JuaUJLQnBaajNiQ2MKcXkwSUdrUW1wK1NuS0NXamlWQkdoRGtBSGVHVCsvUTRCR2RNak90V2VLZDZvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVUNMdVB4ZGVyNndyb2dDNkh6ZnZ4CkNPYVhmNXd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnUVRnZnNmM09mcW5zdmd4UTUrcFlVb1Rob3lzdDAyVnUKL29obi81YXdWTTRDSUhsK0xvOEJuSy9BTGkrc1NjZ2J4SXZVNzZXQ204OHlpMGtwRWdzb1I5dGoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUx6c3RiMEF4ZWtrK05FVnZRQ2g3R2FPYkZtZEJZNlNXL2l5MVJrSmo3MTVvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK1ZsS0ZBaUxzY3E0YUFnMlNFcE5GUU56VmxlTTFFRXRiVTVncVNmd21ad0lxYXpuOS9tMwp3enpEOVhwYnluZHFaTEVFQjE2dzRaTzJhdi8zY1A3dzhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
{}
Error executing code: MCP error -32603: MCP error -32603: Tool execution failed: Error: self-signed certificate in certificate chain✍ Manually verifying
$ kubectl get namespaces
error: specifying a root certificates file with the insecure flag is not allowed
$ kubectl get namespaces
NAME STATUS AGE
default Active 7d15h
kube-node-lease Active 7d15h
kube-public Active 7d15h
kube-system Active 7d15h❓ Questions
This is my {
"mcpServers": {
"filesystem": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"--mount", "type=bind,src=/Users/mdesales/dev,dst=/projects/dev",
"mcp/filesystem",
"/projects"
]
},
"kubernetes": {
"command": "npx",
"args": ["mcp-server-kubernetes"]
}
}
} |
Making sure I understand this correctly - did you restart Claude desktop after the file changes? (or at least made sure that the The kubernetes MCP server loads your kube config once and then caches it - https://github.com/Flux159/mcp-server-kubernetes/blob/main/src/utils/kubernetes-manager.ts#L15 and it's initialized here: https://github.com/Flux159/mcp-server-kubernetes/blob/main/src/index.ts#L71 |
|
@Flux159 hummm That might be the reason... The cache... I only update it and restart Claude but without removing and adding it back.. Maybe that might be the reason... I will make sure to follow the steps and report back... |
|
@Flux159 here are the observations...
$ export KUBECONFIG=
📛 [email protected] 🎡 [email protected] 👽 [email protected] 🐳 [email protected] 🐙 [email protected]
👮
We found a Keybase service (keybase.service) but it's not running.
You might try starting it: keybase launchd start keybase.service
~/dev/github.com/marcellodesales/model-context-protocol-servers/src/github on feature/github/support-enterprise-github-server-urls! 📅 04-03-2025 ⌚20:06:29
$ kubectl get nodes
Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authorityI think I can now understand the confusion of why that is the case based on the default code... Here's what I have attempted before figuring out that the actual server being hit is from the Rancher cluster running remotely
$ kubectl config view
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://console.rancher.az.company.com/k8s/clusters/c-m-zstxchb8
name: az-eastus-security-openai-prod
- cluster:
certificate-authority-data: DATA+OMITTED
server: https://az-eastus-security-openai-prod-api.rancher.az.company.com
name: az-eastus-security-openai-prod-fqdn
contexts:
- context:
cluster: az-eastus-security-openai-prod
user: az-eastus-security-openai-prod
name: az-eastus-security-openai-prod
- context:
cluster: az-eastus-security-openai-prod-fqdn
user: az-eastus-security-openai-prod
name: az-eastus-security-openai-prod-fqdn
current-context: az-eastus-security-openai-prod
kind: Config
preferences: {}
users:
- name: az-eastus-security-openai-prod
user:
token: REDACTED
$ kubectl get namespaces
NAME STATUS AGE
azure-chatgpt-az-eastus-prdt-ppd-dev Active 641d
azure-chatgpt-az-eastus-prdt-prd-prd Active 641d
azure-chatgpt-az-eastus-prdt-prd-prd-com Active 713d
azure-chatgpt-az-eastus-prdt-prd-stg Active 641d
cattle-dashboards Active 2y4d
cattle-fleet-system Active 2y4d
cattle-gatekeeper-system Active 2y4d
cattle-impersonation-system Active 2y4d
cattle-logging-system Active 2y4d
cattle-monitoring-system Active 2y4d
cattle-neuvector-system Active 2y4d
cattle-system Active 2y4d
cattle-ui-plugin-system Active 189d
cert-manager Active 722d
contour-external Active 717d
contour-internal Active 717d
default Active 2y4d
direktiv-az-eastus-prdt-prd-prd Active 718d
direktiv-services-direktiv Active 718d
external-dns Active 2y4d
external-dns-public Active 612d
ghasapp-az-eastus-pltf-prd-prd Active 478d
ghasm-az-eastus-pltf-ppd-dev Active 548d
infoblox-external-dns Active 2y3d
istio-system Active 2y
knative-eventing Active 715d
knative-serving Active 715d
kube-node-lease Active 2y4d
kube-public Active 2y4d
kube-system Active 2y4d
local Active 2y4d
nginx Active 699d
oauth2-proxy-gpt-com-prd Active 713d
oauth2-proxy-gpt-prd Active 681d
oauth2-proxy-gpt-stg Active 681d
postgres Active 719d
vault-infra Active 2y4d
velero Active 2y4d🧠 From Claude
Then, it attempts to find but fails: I'll list the namespaces in your Kubernetes cluster using the provided KUBECONFIG file.
View result from list_namespaces from kubernetes (local)
{}
Error executing code: MCP error -32603: MCP error -32603: Tool execution failed: Error: self-signed certificate in certificate chainEven though it is trying to connect, it still fails with the same error... The fact that it's caching the default kubernetes file in the home directory may explain that the output is usually the same... |
|
@Flux159 I think there's the theory is correct... The library does load KUBECONFIG from ~/.kube/config... I have replaced it the one from the server above... But for both Racher Enterprise and Rancher K3S clusters, I'm seeing the same problem... Maybe it's time to throw in 🔴 Logs with the bug ending with
|
|
I can guarantee that While we do use the kubectl cli directly for certain things like To try to resolve your issue though - can you try using |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Problem
Problem: How to use the Kubernetes MCP Server to reach this server?
$ docker compose -f docker-compose-k8s.yaml config📓 Notes from the thread
0.1.0loads the default~/.kube/configfile always and caches it in memoryThe text was updated successfully, but these errors were encountered: