prefect-worker certificate verify failed: invalid CA certificate

[Horus-K]

Bug summary

prefect-worker error
I bought this system correctly from AWS and EKS before, but it's throwing an error in Vultr Kubernetes.

[notice] To update, run: pip install --upgrade pip
Discovered type 'kubernetes' for work pool 'k8s-pool'.
09:34:54.060 | WARNING | prefect.events.clients - Your Prefect server is running an older version of Prefect than your client which may result in unexpected behavior. Please upgrade your Prefect server from version 3.6.22 to version 3.7.1 or higher.
09:34:54.079 | ERROR   | kopf._core.reactor.observation - Request attempt #1/9 failed; will retry: GET https://10.96.0.1:443/api -> ClientConnectorCertificateError(ConnectionKey(host='10.96.0.1', port=443, is_ssl=True, ssl=True, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1032)'))
09:34:54.081 | ERROR   | kopf._core.reactor.observation - Request attempt #1/9 failed; will retry: GET https://10.96.0.1:443/apis -> ClientConnectorCertificateError(ConnectionKey(host='10.96.0.1', port=443, is_ssl=True, ssl=True, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1032)'))
Worker 'k8s-worker-1' started!
09:34:55.086 | ERROR   | kopf._core.reactor.observation - Request attempt #2/9 failed; will retry: GET https://10.96.0.1:443/api -> ClientConnectorCertificateError(ConnectionKey(host='10.96.0.1', port=443, is_ssl=True, ssl=True, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1032)'))
09:34:55.087 | ERROR   | kopf._core.reactor.observation - Request attempt #2/9 failed; will retry: GET https://10.96.0.1:443/apis -> ClientConnectorCertificateError(ConnectionKey(host='10.96.0.1', port=443, is_ssl=True, ssl=True, proxy=None, proxy_auth=None, proxy_headers_hash=None), SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1032)'))

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "17"
  creationTimestamp: 2026-05-18T13:12:04Z
  generation: 18
  name: prefect-worker
  namespace: prefect
  resourceVersion: "2236379"
  uid: 1b1a5328-74a0-460c-8397-146cac539c9a
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: prefect-worker
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/restartedAt: 2026-05-21T09:34:18.874Z
      labels:
        app: prefect-worker
    spec:
      automountServiceAccountToken: true
      containers:
        - command:
            - /bin/sh
            - -c
            - >
              pip install prefect-kubernetes && prefect worker start --pool
              k8s-pool --name k8s-worker-1 --limit 5
          env:
            - name: PREFECT_API_URL
              value: http://prefect-server:4200/api
          image: prefecthq/prefect:3.6.22-python3.13
          imagePullPolicy: IfNotPresent
          name: worker
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: prefect-worker
      serviceAccountName: prefect-worker
      terminationGracePeriodSeconds: 30
---
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2026-05-21T08:32:32Z
  name: prefect-worker
  namespace: prefect
automountServiceAccountToken: true
secrets:
  - name: prefect-worker-token

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: 2026-05-21T09:34:12Z
  name: prefect-worker
  namespace: prefect
  resourceVersion: "2236158"
  uid: d03ba8ea-969a-4e6f-9a45-c63ea943d983
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: prefect-worker
subjects:
  - kind: ServiceAccount
    name: prefect-worker
    namespace: prefect
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: 2026-05-21T09:34:27Z
  name: prefect-worker
  namespace: prefect
  resourceVersion: "2236200"
  uid: 9eecce4f-38c5-4223-ab5a-70b2256236e9
rules:
  - apiGroups:
      - ""
    resources:
      - events
      - pods
      - pods/log
      - pods/status
    verbs:
      - get
      - watch
      - list
  - apiGroups:
      - batch
    resources:
      - jobs
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete

Version info

prefecthq/prefect:3.6.22-python3.11

Additional context

No response