Unable to reach the api server.

@Fernando Gutierrez

This error can occur when you are trying to access the API server of a private AKS cluster from the Azure portal or other tools that are not within the same virtual network as the cluster. The error means that the API server is not reachable or is too busy to handle the request. Some possible causes and solutions are:

Check your network settings and make sure you are connected to a VPN that can access the AKS cluster’s virtual network. See Options for connecting to the private cluster for more details.

Check if the DNS resolution is working by using the nslookup command with the FQDN of your AKS cluster. You can get the FQDN by using the az aks show command with your resource group and cluster name. See Troubleshoot cluster connection issues with the API server for more details.

Check if the API server is reachable by using the curl or telnet commands with the FQDN and port 443 of your AKS cluster. See Troubleshoot cluster connection issues with the API server for more details.

Check if your client IP address is allowed by the API server by using the az aks update command with the --api-server-authorized-ip-ranges parameter. See Client IP address can’t access the API server for more details.

Check if your kubectl version is compatible with your AKS cluster version by using the kubectl version command. You can install the latest version of kubectl by using the az aks install-cli command. See Troubleshoot cluster connection issues with the API server for more details.

Check if your Kubernetes configuration file (config) is valid and available by using the kubectl config view command. You can get a new config file by using the az aks get-credentials command with your resource group and cluster name. See Config file isn’t available when connecting for more details.

Check if you have sufficient permissions to access the cluster resources by using the kubectl auth can-i command with your desired action and resource. You can grant or revoke permissions by using the kubectl create rolebinding or kubectl delete rolebinding commands. See User can’t get cluster resources for more details.

Check if your firewall or network security group allows egress traffic from AKS worker nodes to the API server on TCP port 10250. You can view or modify your firewall or network security group rules by using the Azure portal or CLI. See Minimum required egress rules for AKS and Network security groups for more details.

I hope this helps you resolve your issue. If you have any further questions, please let me know.

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!