Question: running k3s with external etcd in kubernetes #8062
-
|
Environmental Info: K3s Version: Etcd Version: Node(s) CPU architecture, OS, and Version: Cluster Configuration:
Describe the bug: Steps To Reproduce:
Expected behavior: What is not clear for me is how to configure the etcd user/password in k3s when using rbac auth instead of certificate authentication. I am reporting the same issue in vcluster project but believe this is more to do with k3s and my configuration. Actual behavior: Additional context / logs: |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 3 replies
-
Does Kubernetes support this? We just pass the datastore endpoint through to the apiserver as the |
Beta Was this translation helpful? Give feedback.
-
|
OK that's why I specifically asked the question here (one tends to forget that k3s follows the standard k8s config!). If this is not supported I can either try the certificate authentication or even easier start testing without authentication to figure out if this is an auth problem or not. |
Beta Was this translation helpful? Give feedback.
-
|
I would probably recommend just using client cert auth, as that is the pattern that upstream Kubernetes documents, and is what all Kubernetes distros that I'm aware of use. I don't believe I've ever seen anyone try to use username/password auth. |
Beta Was this translation helpful? Give feedback.
-
|
agree - I thought I could cut some corners for testing. So I have to provide 3 more env variables: the CA file, the cert file and the keyfile. Correct? |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
I would appreciate some additional detail regarding the etcd ca.cert and client cert + key files:
Thanks in advance. |
Beta Was this translation helpful? Give feedback.
-
|
You can do whatever you want and put the files wherever you want, since you're setting up etcd yourself. K3s just needs to be able to access the etcd CA cert (so that it trusts etcd's server cert), and the client cert+key (so that it can auth to etcd). How you provision those files is up to you as the administrator of the etcd cluster. |
Beta Was this translation helpful? Give feedback.
-
|
Just wondering, there isn't any documentation or example how to connect k3s in vcluster to external etcd provided by Bitnami Helm Chart. Relates values for Bitnami etcd Helm chart: auth:
client:
enableAuthentication: false
secureTransport: false
rbac:
allowNoneAuthentication: true
create: false
rootPassword: a12345678
token:
enabled: false
image:
debug: true
loglevel: debug
replicaCount: 3values for vcluster: env:
- name: K3S_DATASTORE_ENDPOINT
value: http://vc2-etcd-0.vc2-etcd-headless.vc2.svc.cluster.local:2379,http://vc2-etcd-1.vc2-etcd-headless.vc2.svc.cluster.local:2379,http://vc2-etcd-2.vc2-etcd-headless.vc2.svc.cluster.local:2379
extraArgs:
- --token=a12345678
- --debug
- -v 1
image: /rancher/k3s:v1.28.1-k3s1-amd64
k3s:
workloadKind: StatefulSet
storage:
persistence: falseMy complete Crossplane Composition. Would love to see a working example of etcd/k3s with TLS. |
Beta Was this translation helpful? Give feedback.
I would probably recommend just using client cert auth, as that is the pattern that upstream Kubernetes documents, and is what all Kubernetes distros that I'm aware of use. I don't believe I've ever seen anyone try to use username/password auth.