Task

The kube-auth-api DaemonSet is deployed to controlplane nodes, in Rancher v2.3+ provisioned Kubernetes clusters, to provide user authentication functionality for the authorized cluster endpoint. When troubleshooting an issue with authorized cluster endpoint authentication, it may be helpful to analyse the kube-auth-api logs at debug level, and this article details how to enable debug logging.

Pre-requisites

• A Rancher v2.3+ instance
• A Rancher provisioned Kubernetes cluster, either a custom cluster or on nodes in an infrastructure provider using a Node Driver

Resolution

1. Navigate to the workloads view of the System project, within the Rancher UI, for the relevant Rancher provisioned cluster.

2. Locate the kube-api-auth DaemonSet, within the cattle-system namespace, click the vertial elipses and select Edit, per the following screenshot:

   

3. Click Show advanced options in the bottom left.

4. Expand the Command section, enter /usr/bin/kube-api-auth --debug serve in the Command field, per the following screenshat, and click Save:

   

5. The kube-api-auth pod(s) will restart with the new debug logging configuration. Viewing the kube-api-auth logs you should now obeserve log messages with level=debug.

Further reading

• Rancher documentation on the kube-api-auth authentication webhook
• Rancher Server Architecture documentation