已知问题 - 使用 AKS 群集进行部署期间证书无效错误

适用于:Python SDK azureml v1

在使用 AKS 群集进行机器学习部署期间,可能会收到证书无效错误,例如 {"code":"BadRequest","statusCode":400,"message":"The request is invalid.","details":[{"code":"KubernetesUnaccessible","message":"Kubernetes error: AuthenticationException. Reason: InvalidCertificate"}]

状态:待处理

问题区域: 推理

症状

使用 AKS 群集进行 Azure 机器学习部署失败,并出现错误:

{"code":"BadRequest","statusCode":400,"message":"The request is invalid.","details":[{"code":"KubernetesUnaccessible","message":"Kubernetes error: AuthenticationException. Reason: InvalidCertificate"}], ,MMS 日志中显示以下错误:

K8sReadNamespacedServiceAsync failed with AuthenticationException: System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback. at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception) at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions) at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](tioadapteradapterbooleanreceivefirstbytereauthenticationdatabooleanisapm) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)

原因

发生此错误的原因是,在 2021 年 1 月之前创建的 AKS 群集的证书不包括 Subject Key Identifier 值,这会阻止生成所需的 Authority Key Identifier 值。

解决方案和缓解措施

可以通过以下两种方式解决此问题:

后续步骤