Edit

Client IP address can't access the API server for Azure Kubernetes Service

Summary

This article explains how to troubleshoot when a client IP address can't access the API server for Azure Kubernetes Service (AKS) so you can restore connectivity to your cluster.

Prerequisites

Ensure the following prerequisites are met before troubleshooting access to the AKS API server:

Symptoms

The following symptoms indicate that your client IP address can't access the AKS API server.

When you try to access Kubernetes resources such as namespaces and workloads from the Azure portal, you might encounter the following error.

Network error

Unable to reach the api server 'https://<API-server-FQDN>' or api server is too busy to respond. Check your network settings and refresh to try again.

Screenshot of the AKS portal view showing a network error when connecting to the API server from namespaces and workloads.

Cause

You might have enabled API server-authorized IP ranges on the cluster's API server, but you didn't include the client's IP address in the IP ranges. To check whether this feature is enabled, see if the following az aks show command in Azure CLI returns a list of IP ranges.

az aks show --resource-group ${RG_NAME} \
    --name ${CLUSTER_NAME} \
    --query apiServerAccessProfile.authorizedIpRanges

Solution

Look at the cluster's API server-authorized ranges, and add your client's IP address within that range.

Note

Do you access the API server from a corporate network where traffic routes through a proxy server or firewall? If so, ask your network administrator before you add your client IP address to the list of authorized ranges for the API server. Also, ask your cluster administrator before you add your client IP address, because there might be security concerns with adding a temporary IP address to the list of authorized ranges.

Follow these steps to add your client IP address to the authorized IP ranges for the AKS API server:

  1. Go to the cluster in the Azure portal.

  2. In the left menu, find Settings and then select Networking.

  3. On the Networking page, select the Overview tab.

  4. Select Manage under Resource settings.

  5. In the Authorized IP ranges pane, add your client IP address as shown in the following screenshot.

    Screenshot of the Authorized IP ranges pane in the Azure portal where you add a client IP address to the AKS API server.

  • Last updated on