Lab 4.1 Part 4

tomp736

@serewicz

a) paths are incorrect - should be full path
b) command is incorrect - etdctl should be before the parameters

kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 --cert=./peer.crt --key=./peer.key --cacert=./ca.crt etcdctl --endpoints=https://127.0.0.1:2379 member list"

Should be.

kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 etcdctl --cert=/etc/kubernetes/pki/etcd/peer.crt --key=/etc/kubernetes/pki/etcd/peer.key --cacert=/etc/kubernetes/pki/etcd/ca.crt --endpoints=https://127.0.0.1:2379 member list"

Sometimes this sort of thing helps my learning, but in this case it is was totally frustrating inconvenience. If someone was being vigilant maybe they would catch this. But why does this sort of issue have to exist at all? Would you be able to update these documents?

thomas.bucaioni

It seems the ETCDCTL_xxx variables and the 'member list' command are incomptible:

k -n kube-system exec etcd-k8scp -it -- sh -c \
'ETCDCTL_API=3 etcdctl member list \
--cacert="/etc/kubernetes/pki/etcd/ca.crt" \
--cert="/etc/kubernetes/pki/etcd/server.crt" \
--key="/etc/kubernetes/pki/etcd/server.key"'

is ok but

k -n kube-system exec etcd-k8scp -it -- sh -c \
'ETCDCTL_API=3 \
ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
etcdctl member list'

isn't. And

k -n kube-system exec etcd-k8scp -it -- sh -c \
'ETCDCTL_API=3 \
ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
etcdctl endpoint health -w table'

is fine again

oleksazhel

@thomas.bucaioni It's because of incorrect spelling of ECTDCTL_CACERT . There must be ETCDCTL_CACERT

thomas.bucaioni

Hi @oleksazhel then the certificates are not mandatory for the health command, because there was a typo too?

oleksazhel

@thomas.bucaioni it doesn't work for health command as well. If you check output you'll find that there is warning and ERROR about context deadline exceeded.

thomas.bucaioni

@oleksazhel indeed, I must have mistaken the commands. By the way, what happens after the expiration date:

$ cat /etc/kubernetes/pki/etcd/ca.crt | openssl x509 -noout -enddate
notAfter=Jun 30 17:26:05 2032 GMT

Does the cluster renew all its certificates itself?

oleksazhel

@thomas.bucaioni Let's see in 10 years))