Skip to content
    • Welcome to the Linux Foundation Forum!

    Lab 4.1 Part 4

    Posts: 13
    edited March 2022 in LFS258 Class Forum

    @serewicz

    a) paths are incorrect - should be full path
    b) command is incorrect - etdctl should be before the parameters

    1. kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 --cert=./peer.crt --key=./peer.key --cacert=./ca.crt etcdctl --endpoints=https://127.0.0.1:2379 member list"

    Should be.

    1. kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 etcdctl --cert=/etc/kubernetes/pki/etcd/peer.crt --key=/etc/kubernetes/pki/etcd/peer.key --cacert=/etc/kubernetes/pki/etcd/ca.crt --endpoints=https://127.0.0.1:2379 member list"

    Sometimes this sort of thing helps my learning, but in this case it is was totally frustrating inconvenience. If someone was being vigilant maybe they would catch this. But why does this sort of issue have to exist at all? Would you be able to update these documents?

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Comments

    • Posts: 207

      It seems the ETCDCTL_xxx variables and the 'member list' command are incomptible:

      1. k -n kube-system exec etcd-k8scp -it -- sh -c \
      2. 'ETCDCTL_API=3 etcdctl member list \
      3. --cacert="/etc/kubernetes/pki/etcd/ca.crt" \
      4. --cert="/etc/kubernetes/pki/etcd/server.crt" \
      5. --key="/etc/kubernetes/pki/etcd/server.key"'

      is ok but

      1. k -n kube-system exec etcd-k8scp -it -- sh -c \
      2. 'ETCDCTL_API=3 \
      3. ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
      4. ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
      5. ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
      6. etcdctl member list'

      isn't. And

      1. k -n kube-system exec etcd-k8scp -it -- sh -c \
      2. 'ETCDCTL_API=3 \
      3. ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
      4. ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
      5. ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
      6. etcdctl endpoint health -w table'

      is fine again

    • Posts: 57

      @thomas.bucaioni It's because of incorrect spelling of ECTDCTL_CACERT . There must be ETCDCTL_CACERT

    • Posts: 207

      Hi @oleksazhel then the certificates are not mandatory for the health command, because there was a typo too?

    • Posts: 57

      @thomas.bucaioni it doesn't work for health command as well. If you check output you'll find that there is warning and ERROR about context deadline exceeded.

    • Posts: 207

      @oleksazhel indeed, I must have mistaken the commands. By the way, what happens after the expiration date:

      1. $ cat /etc/kubernetes/pki/etcd/ca.crt | openssl x509 -noout -enddate
      2. notAfter=Jun 30 17:26:05 2032 GMT

      Does the cluster renew all its certificates itself?

    • Posts: 57

      @thomas.bucaioni Let's see in 10 years))

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Quick Links

    Categories

    Upcoming Training