[Bug 1274854] kubectl exec: handshake did not verify certificate chain

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1274854

--- Comment #1 from Jan Chaloupka  ---
I am able to reproduce it.

Steps:
1) install the latest k8s and start all services
2) update apiserver config and remove ServiceAccount from admission control
3) restart kube-apiserver
3) create mock.yaml file:# cat mock.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: mock
spec:
  containers:
  - name: mock
    image: rusintez/mock

4) kubectl create -f mock.yaml

Running command:
# kubectl exec --v=9 mock /bin/sh -i
I1027 09:11:04.821317    9945 debugging.go:101] curl -k -v -XGET  -H
"User-Agent: kubectl/v1.0.6 (linux/amd64) kubernetes/388061f"
http://localhost:8080/api
I1027 09:11:04.822881    9945 debugging.go:120] GET http://localhost:8080/api
200 OK in 1 milliseconds
I1027 09:11:04.822904    9945 debugging.go:126] Response Headers:
I1027 09:11:04.822915    9945 debugging.go:129]     Content-Length: 32
I1027 09:11:04.822927    9945 debugging.go:129]     Content-Type:
application/json
I1027 09:11:04.822937    9945 debugging.go:129]     Date: Tue, 27 Oct 2015
08:11:04 GMT
I1027 09:11:04.822968    9945 request.go:779] Response Body: {
  "versions": [
    "v1"
  ]
}
I1027 09:11:04.823272    9945 debugging.go:101] curl -k -v -XGET  -H
"User-Agent: kubectl/v1.0.6 (linux/amd64) kubernetes/388061f"
http://localhost:8080/api/v1/namespaces/default/pods/mock
I1027 09:11:04.826041    9945 debugging.go:120] GET
http://localhost:8080/api/v1/namespaces/default/pods/mock 200 OK in 2
milliseconds
I1027 09:11:04.826065    9945 debugging.go:126] Response Headers:
I1027 09:11:04.826077    9945 debugging.go:129]     Content-Type:
application/json
I1027 09:11:04.826087    9945 debugging.go:129]     Date: Tue, 27 Oct 2015
08:11:04 GMT
I1027 09:11:04.826098    9945 debugging.go:129]     Content-Length: 973
I1027 09:11:04.826143    9945 request.go:779] Response Body:
{"kind":"Pod","apiVersion":"v1","metadata":{"name":"mock","namespace":"default","selfLink":"/api/v1/namespaces/default/pods/mock","uid":"33334b8c-7c81-11e5-a55a-525400e11373","resourceVersion":"2196","creationTimestamp":"2015-10-27T08:03:25Z"},"spec":{"containers":[{"name":"mock","image":"rusintez/mock","resources":{},"terminationMessagePath":"/dev/termination-log","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","dnsPolicy":"ClusterFirst","nodeName":"127.0.0.1"},"status":{"phase":"Running","conditions":[{"type":"Ready","status":"True"}],"hostIP":"127.0.0.1","podIP":"172.17.0.1","startTime":"2015-10-27T08:03:25Z","containerStatuses":[{"name":"mock","state":{"running":{"startedAt":"2015-10-27T08:05:41Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"rusintez/mock","imageID":"docker://ca5d0df8796cc6bc30808508084d3ed31b229aec6678ceaf52b5fe295adacac9","containerID":"docker://4f96a3af5476d8cd5d80269976dfa0defb4081fd5b57cc5d2bdcc3704985d951"}]}}
I1027 09:11:04.826794    9945 exec.go:127] defaulting container name to mock
F1027 09:11:04.861602    9945 helpers.go:72] error: Unable to upgrade
connection: {
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {},
  "status": "Failure",
  "message": "tls: handshake did not verify certificate chain",
  "code": 500
}