Client IP address can't access the API server

Article
10/08/2024

This article describes how to fix issues that occur when you can't connect to an Azure Kubernetes Service (AKS) cluster because your client IP address can't access the AKS API server.

Prerequisites

Azure CLI.
The client URL (curl) tool.

Symptoms

Azure portal
Azure CLI

When you try to access Kubernetes resources such as mamespaces and workloads from the Azure portal, you might encounter the following errors:

Network error

Unable to reach the api server 'https://<API-server-FQDN>' or api server is too busy to respond. Check your network settings and refresh to try again.

When you try to connect to a cluster using the Azure CLI, you might see the following errors:

"Unhandled Error" err="couldn't get current server API group list: Get \"https://<API-SERVER-FQDN>:443/api?timeout=32s\": dial tcp <API-SERVER-IP>:443: i/o timeout"

Unable to connect to the server: dial tcp <API-SERVER-IP>:443: i/o timeout

Unable to connect to the server: dial tcp <API-SERVER-IP>:443: connectex: A connection attempt failed because the connected party did not properly respond after a period, or established connection failed because connected host has failed to respond.

Cause

API server-authorized IP ranges may have been enabled on the cluster's API server, but the client's IP address wasn't included in the IP ranges. To check whether this feature has been enabled, see if the following az aks show command in Azure CLI produces a list of IP ranges:

az aks show --resource-group <cluster-resource-group> \
    --name <cluster-name> \
    --query apiServerAccessProfile.authorizedIpRanges

Solution

Look at the cluster's API server-authorized ranges, and add your client's IP address within that range.

Note

Do you access the API server from a corporate network where traffic is routed through a proxy server or firewall? Then ask your network administrator before you add your client IP address to the list of authorized ranges for the API server.
Also ask your cluster administrator before you add your client IP address, because there might be security concerns with adding a temporary IP address to the list of authorized ranges.

Azure portal
Azure CLI

Navigate to the cluster from the Azure portal.
In the left menu, locate Settings and then select Networking.
On the Networking page, select the Overview tab.
Select Manage under Resource settings.
In the Authorized IP ranges pane, add your client IP address as shown in the following screenshot:

Get your client IP address by running this curl command:

$ curl --silent checkip.dyndns.org
<html><head><title>Current IP Check</title></head><body>Current IP Address: 0.255.127.63</body></html>

Update the API server-authorized range with the az aks update command in Azure CLI, using your client IP address:

az aks update --resource-group <cluster-resource-group> \
    --name <cluster-name> \
    --api-server-authorized-ip-ranges <ip-ranges-that-include-your-client-ip-address>

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.

Share via