Welcome to the Linux Foundation Forum!

Lab 4.1 Part 4

tomp736
tomp736 Posts: 13
edited March 2022 in LFS258 Class Forum

@serewicz

a) paths are incorrect - should be full path
b) command is incorrect - etdctl should be before the parameters

kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 --cert=./peer.crt --key=./peer.key --cacert=./ca.crt etcdctl --endpoints=https://127.0.0.1:2379 member list"

Should be.

kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 etcdctl --cert=/etc/kubernetes/pki/etcd/peer.crt --key=/etc/kubernetes/pki/etcd/peer.key --cacert=/etc/kubernetes/pki/etcd/ca.crt --endpoints=https://127.0.0.1:2379 member list"

Sometimes this sort of thing helps my learning, but in this case it is was totally frustrating inconvenience. If someone was being vigilant maybe they would catch this. But why does this sort of issue have to exist at all? Would you be able to update these documents?

Comments

  • thomas.bucaioni
    thomas.bucaioni Posts: 207

    It seems the ETCDCTL_xxx variables and the 'member list' command are incomptible:

    k -n kube-system exec etcd-k8scp -it -- sh -c \
'ETCDCTL_API=3 etcdctl member list \
--cacert="/etc/kubernetes/pki/etcd/ca.crt" \
--cert="/etc/kubernetes/pki/etcd/server.crt" \
--key="/etc/kubernetes/pki/etcd/server.key"'

    is ok but

    k -n kube-system exec etcd-k8scp -it -- sh -c \
'ETCDCTL_API=3 \
ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
etcdctl member list'

    isn't. And

    k -n kube-system exec etcd-k8scp -it -- sh -c \
'ETCDCTL_API=3 \
ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
etcdctl endpoint health -w table'

    is fine again

  • oleksazhel
    oleksazhel Posts: 57

    @thomas.bucaioni It's because of incorrect spelling of ECTDCTL_CACERT . There must be ETCDCTL_CACERT

  • thomas.bucaioni
    thomas.bucaioni Posts: 207

    Hi @oleksazhel then the certificates are not mandatory for the health command, because there was a typo too?

  • oleksazhel
    oleksazhel Posts: 57

    @thomas.bucaioni it doesn't work for health command as well. If you check output you'll find that there is warning and ERROR about context deadline exceeded.

  • thomas.bucaioni
    thomas.bucaioni Posts: 207

    @oleksazhel indeed, I must have mistaken the commands. By the way, what happens after the expiration date:

    $ cat /etc/kubernetes/pki/etcd/ca.crt | openssl x509 -noout -enddate
notAfter=Jun 30 17:26:05 2032 GMT

    Does the cluster renew all its certificates itself?

  • oleksazhel
    oleksazhel Posts: 57

    @thomas.bucaioni Let's see in 10 years))

Categories

Upcoming Training