x509: certificate has expired or is not yet valid: current time 2022-07-28T20:34:57Z is after 2022-06-28T00:00:24Z

[manherfo]

Hi guys,

I came here to ask maybe for some guidance on how to solve this issue "x509: certificate has expired or is not yet valid: current time 2022-07-28T20:34:57Z is after 2022-06-28T00:00:24Z"

I get this log after deploying the helm chart in version 0.16.0. if I try to get the resources I get:

$ k get all -n ghes-external-runners-test
NAME                                                                  READY   STATUS    RESTARTS   AGE
pod/ghes-external-test-actions-runner-controller-66f7595d5-2vfzd      2/2     Running   0          4h40m
pod/ghes-external-test-actions-runner-controller-github-webhoov9tj4   2/2     Running   0          4h28m

NAME                                                                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
service/ghes-external-test-actions-runner-controller-github-webhook-ser   NodePort    10.10a.13a.a     <none>        80:30699/TCP   4h40m
service/ghes-external-test-actions-runner-controller-metrics-service      ClusterIP   10.10a.1a.a      <none>        8443/TCP       4h40m
service/ghes-external-test-actions-runner-controller-webhook              ClusterIP   10.10a.20a.a     <none>        443/TCP        4h40m

NAME                                                                              READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/ghes-external-test-actions-runner-controller                      1/1     1            1           4h40m
deployment.apps/ghes-external-test-actions-runner-controller-github-webhook-ser   1/1     1            1           4h40m

NAME                                                                                        DESIRED   CURRENT   READY   AGE
replicaset.apps/ghes-external-test-actions-runner-controller-66f7595d5                      1         1         1       4h40m
replicaset.apps/ghes-external-test-actions-runner-controller-github-webhook-ser-5d597d8f9   1         1         1       4h40m

Everything looks good so far but when I try to deploy the runnerdeployment with the following specification:

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: ghes-external-runners-test-autoscale
  namespace: ghes-external-runners-test
spec:
  template:
    spec:
      enterprise: enterprise
      nodeSelector:
        Environment: eks-github-ghes-prod
      labels:
        - k8s-runner
        - self-hosted
        - external-k8s
        - ghes-external-runners-test
      ephemeral: true
---
apiVersion: actions.summerwind.dev/v1alpha1
kind: HorizontalRunnerAutoscaler
metadata:
  name: ghes-external-runners-test-autoscale-autoscaler
  namespace: ghes-external-runners-test
spec:
  scaleTargetRef:
    name: ghes-external-runners-test-autoscale
  minReplicas: 2
  maxReplicas: 10
  scaleUpTriggers:
  - githubEvent: {}
    duration: "1m"

I get the following output:

k apply -f runnerdeployment.yaml -n ghes-external-runners-test
horizontalrunnerautoscaler.actions.summerwind.dev/ghes-external-runners-test-autoscale-autoscaler unchanged
Error from server (InternalError): error when creating "runnerdeployment.yaml": Internal error occurred: failed calling webhook "mutate.runnerdeployment.actions.summerwind.dev": Post "[https://github-enterprise-server-actions-runner-controller-webhook.ghes-k8s-runners.svc:443/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment?timeout=10s":](https://github-enterprise-server-actions-runner-controller-webhook.ghes-k8s-runners.svc/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment?timeout=10s%22:) x509: certificate has expired or is not yet valid: current time 2022-07-28T20:34:57Z is after 2022-06-28T00:00:24Z

I appreciate any helm here.

Thanks in advance

[vittico]

I am having the exact same issue @manherfo is reporting

[afmunoz1477]

Having the same issue here 🤕

[manherfo]

Please notice that despite the helm deployment being done in the ghes-external-runners-test namespace, the error is calling https://github-enterprise-server-actions-runner-controller-webhook.ghes-k8s-runners.svc:443/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment?timeout=10s

(https://github-enterprise-server-actions-runner-controller-webhook.ghes-k8s-runners.svc/mutate-actions-summerwind-dev-v1alpha1-runnerdeployment?timeout=10s%22:)

and this is the config in my values yaml:

scope:
  # If true, the controller will only watch custom resources in a single namespace
  singleNamespace: true
  # If `scope.singleNamespace=true`, the controller will only watch custom resources in this namespace
  # The default value is "", which means the namespace of the controller
  watchNamespace: "ghes-k8s-internal-runners"

[tommy-sho]

I faced the same problem. In my case, the problem was that cert-manger failed to renew the certificate and the certificate had expired. So I created Certificates and Issuer again and renewed the certificate.

As a result, actions-controller uses the new certificate and the problem was solved, but I have no idea why cert-manager failed to renew the certificate.

I hope this is helpful.

[dmitrijrub]

Hi do can you share how you updated the certificates?

[dmitrijrub]

Solved it by deleting cert and redeploying helm chart

[acullenn]

To anyone else encountering this issue - you might not have cert-manager installed
https://cert-manager.io/v1.4-docs/installation/helm/

I had installed the CRDs separately but neglected to actually follow up with the helm installation. Installing cert-manager resolved the issue for me almost immediately.

[samus-aran]

We're locking this discussion because it has not had recent activity. Thank you for helping us maintain a productive and tidy community for all our members.