Error accessing API with k8studio while kubectl can access

[carlospolop]

---

App Version 3.1.2
Arch: arm64
Platform: darwin
osRelease: 24.5.0
Locale: en-US

I'm getting this error:

However, I can access to the cluster using kubectl.

I'm accessing to an EKS cluster through a VPN (Cloudflare WARP), is there anything I could do to make k8studio properly connect to the API?

[guiqui]

Thank you for reporting this issue. It looks like the problem is on our end, since kubectl itself doesn’t seem to be affected. We’ll work on reproducing the issue using the same setup you described and will follow up once we have more details.
BTW so is eks through a vpn, anything else?

[guiqui]

I have set up an EKS cluster running privately and an EC2 instance in the same VPC. The EC2 can connect to the cluster API and create a Cloudflare tunnel between the EC2 and Cloudflare.

Using WARP in Zero Trust mode on my local machine, both kubectl and K8 Studio are able to log in, so both clients can reach the private EKS Kubernetes API.

The issue with K8 Studio seems to occur when executing the exec command for authentication.

In the kubeconfig (or wherever the cluster configuration is stored), under the users section, there is a block with the authentication command. In my case it looks like this:

users:

• name: arn:aws:eks:us-east-1:fakeid:cluster/fakeclusterid
  user:
  exec:
  apiVersion: client.authentication.k8s.io/v1beta1
  args:
  - --region
  - us-east-1
  - eks
  - get-token
  - --cluster-name
  - fakeclusterid
  - --output
  - json
  command: aws
  env: null
  interactiveMode: IfAvailable
  provideClusterInfo: false

We believe K8 Studio may be having issues executing this command. Could you share your exec command (removing the user ARN and real cluster name so you don’t expose cluster details)?

What we are looking for is:

The apiVersion used in the exec block

The arguments (args) being passed

Also, could you let me know what version of Kubernetes your cluster is running?

[carlospolop]

The configured command is:

- name: arn:aws:eks:us-east-2:[...]
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - --region
      - us-east-2
      - eks
      - get-token
      - --cluster-name
      - [name]
      - --output
      - json
      command: aws

Which as far as I see is the same one as yours.
Is there any way I can check logs from k8studio (that are not the ones in the "Logs" tab as those logs doesn't show anything relevant)?

Btw, I opened a Terminal from the cluster I want to access in K8studio and from that terminal, I'm getting this error:

kubectl get nodes
E0825 12:05:57.242130    2425 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"http://localhost:8080/api?timeout=32s\": dial tcp 127.0.0.1:8080: connect: connection refused"

Not sure why it's trying to access localhost:8080 but maybe this is part of the problem, cause from my own terminal I can execute kubectl get nodes

[guiqui]

Thank you, Carlos!
This is really useful, looks like K8studio is detecting a proxy configuration on http://localhost:8080 from HTTP_PROXY, maybe we are not reading the NO_PROXY properly.
If you open a terminal in K8studio and "printenv", Can you see any of these env variables set?

[carlospolop]

I don't have any proxy related env variable when executing printenv in the terminal inside k8studio or in my own terminal. I also don't have any proxy enabled in the macos network settings.

[carlospolop]

So, I have idea why it's trying to request something at localhost:8080. But I set up a proxy in there and when I try to access the cluster using kubectl from the k8studio terminal now I get:

kubectl get nodes
E0825 16:07:19.475523   23379 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: invalid character '<' looking for beginning of value"
E0825 16:07:19.489919   23379 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: invalid character '<' looking for beginning of value"
E0825 16:07:19.505851   23379 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: invalid character '<' looking for beginning of value"
E0825 16:07:19.520975   23379 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: invalid character '<' looking for beginning of value"
E0825 16:07:19.535046   23379 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: invalid character '<' looking for beginning of value"
error: invalid character '<' looking for beginning of value

So even with a proxy in there something is still failing

[guiqui]

Thinking back to the original error message: the issue is that when K8Studio tries to connect, it gets an Unauthorized error.

Looking at the code, we are making several requests to determine what version of the cluster we’re connecting to, and which resources and API versions we need to use. I believe the problem is that one of these requests is failing due to insufficient permissions.

On the other hand, kubectl doesn’t make the same set of requests, which is why it works without hitting this error.
Does your user have any RBAC restrictions?

[carlospolop]

Yes, I'm doing a security review of a cluster so my permissions are reduced to:

Resources                                       Non-Resource URLs   Resource Names     Verbs
selfsubjectreviews.authentication.k8s.io        []                  []                 [create]
selfsubjectaccessreviews.authorization.k8s.io   []                  []                 [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []                 [create]
*.*                                             []                  []                 [get list watch]
                                                [/api/*]            []                 [get]
                                                [/api]              []                 [get]
                                                [/apis/*]           []                 [get]
                                                [/apis]             []                 [get]
                                                [/healthz]          []                 [get]
                                                [/healthz]          []                 [get]
                                                [/livez]            []                 [get]
                                                [/livez]            []                 [get]
                                                [/openapi/*]        []                 [get]
                                                [/openapi]          []                 [get]
                                                [/readyz]           []                 [get]
                                                [/readyz]           []                 [get]
                                                [/version/]         []                 [get]
                                                [/version/]         []                 [get]
                                                [/version]          []                 [get]
                                                [/version]          []                 [get]
podsecuritypolicies.policy                      []                  [eks.privileged]   [use]

So basically, get, list and watch everywhere

[guiqui]

Thanks, I'm setting a user with the same permissions to check if I can reproduce.

[carlospolop]

Hi @guiqui !
I opened the K8Studio from my own terminal and it actually managed to connect. Not really sure what is going on here, but at least it's working now

[guiqui]

Hum, weird. The only thing that makes sense is that we were inheriting some environment variables from the other terminal. I don't think your user has any issues since . => get list watch