Skip to content
    • Welcome to the Linux Foundation Forum!

    5.7.4 - etcd

    Posts: 32
    in LFS260 Class Forum

    I think it'd be handy showing in the lab how to create the etcd-cp that is used here, presuming it's a copy of etcd that has been created for debugging?

    If I run the command as it is shown I get:
    Error from server (NotFound): pods "etcd-cp" not found

    I'm pretty sure I've seen at some point how to do this, but I cannot remember it.

    If I substitute for the etcd master I'm running, I get an error regarding the CA Cert:

    1. kubectl -n kube-system exec -it etcd-k8smaster -- sh -c "ECTCDCTL_API=3
    2. ETCDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt
    3. ETCDCTL_CERT=/etc/kubernetes/pki/apiserver-etcd-client.crt
    4. ETCDCTL_KEY=/etc/kubernetes/pki/apiserver-etcd-client.key
    5. etcdctl --endpoints=https://127.0.0.1:2379 get /registry/secrets/default/first"
    1. {"level":"warn","ts":"2021-10-15T06:26:54.179Z","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-7bd8bf03-173b-48ff-9305-0a65281c1900/127.0.0.1:2379","attempt":0,"error":"rpc error: code = DeadlineExceeded desc = latest balancer error: all SubConns are in TransientFailure, latest connection error: connection error: desc = \"transport: authentication handshake failed: x509: certificate signed by unknown authority\""}
    2. Error: context deadline exceeded
    3. command terminated with exit code 1

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Comments

    • Posts: 2,434

      Hi @dnx,

      The name of the etcd pod includes the hostname of the control-plane node etcd-hostname. In the example, the hostname is cp.

      Regards,
      -Chris

    • Posts: 32

      Thanks Chris, I wondered that after I posted it, cp threw me off the track haha, guess that's named after you :D Any hint on the error I received?

    • Posts: 2,434

      Hi @dnx,

      The error may be caused by unexpected key and cert files. Did you try running the command with the key and cert shown in the lab guide?

      The multi-line command itself may not be parsed correctly by the command line client especially when copy/pasted from PDF; converting it into a single-line command may also help.

      This is assuming that your etcd pod is named etcd-k8smaster where k8smaster is your control-plane node hostname and not just an alias.

      Regards,
      -CP :wink:

    • Posts: 32

      Here is the output I based that on:

      1. $ k get po --all-namespaces |grep etcd
      2. kube-system   etcd-k8smaster                             1/1     Running   0          2d11h
      3.  
      4. $ sudo grep etcd /etc/kubernetes/manifests/kube-apiserver.yaml
      5.     - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
      6.     - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
      7.     - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
      8.     - --etcd-servers=https://127.0.0.1:2379

      I did manage to get it working:

      1. $ kubectl -n kube-system exec -it etcd-k8smaster -- sh -c "ECTCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt ETCDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt ETCDCTL_KEY=/etc/kubernetes/pki/etcd/server.key etcdctl --endpoints=https://127.0.0.1:2379 get /registry/secrets/default/first"
      2. /registry/secrets/default/first
      3. k8s
      4.  
      5.  
      6. v1Secret
      7.  
      8. firstdefault"*$c02f5f24-a877-4b6a-ab03-8d5ba8fc36de2ȶzb
      9. kubectl-createUpdatevȶFieldsV1:0
      10. .{"f:data":{".":{},"f:somekey":{}},"f:type":{}}
      11. somekeyfindmeOpaque"

      I got the cert details from the following. I'm not sure how /etc/kubernetes/pki/apiserver-etcd-client.crt becomes /etc/kubernetes/pki/etcd/server.crt:

      1. $ k describe po etcd-k8smaster -n kube-system |grep pki
      2.       --cert-file=/etc/kubernetes/pki/etcd/server.crt
      3.       --key-file=/etc/kubernetes/pki/etcd/server.key
      4.       --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt
      5.       --peer-key-file=/etc/kubernetes/pki/etcd/peer.key
      6.       --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      7.       --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
      8.       /etc/kubernetes/pki/etcd from etcd-certs (rw)
      9.     Path:          /etc/kubernetes/pki/etcd

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Quick Links

    Categories

    Upcoming Training