A 911 cluster node has significant clock skew and begins failing TL…

Question

A 911 cluster node has significant clock skew and begins failing TLS authentication to the API server. What should administrators suspect?

Accepted Answer

Time sync problems can invalidate certificate validity windows and produce TLS/auth errors to apiserver. — Certificates are sticklers for the clock. If the node’s watch is hours off, TLS handshakes to the API server fall apart.

Answer

Clock skew only affects horizontal pod autoscaler math and never TLS.

Answer

Clock skew always deletes ServiceAccounts in the default namespace.

Answer

Clock skew only changes ContainerRuntimeVersion labels.

A 911 cluster node has significant clock skew and begins failing TLS authentication to the API server. What should administrators suspect?

Short Explanation

Full Explanation