Welcome to the Linux Foundation Forum!

Lab 4.1 Part 4

tomp736
tomp736 Posts: 13
edited March 2022 in LFS258 Class Forum

@serewicz

a) paths are incorrect - should be full path
b) command is incorrect - etdctl should be before the parameters

kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 --cert=./peer.crt --key=./peer.key --cacert=./ca.crt etcdctl --endpoints=https://127.0.0.1:2379 member list"

Should be.

kubectl -n kube-system exec -it etcd-k8scp -- sh -c "ETCDCTL_API=3 etcdctl --cert=/etc/kubernetes/pki/etcd/peer.crt --key=/etc/kubernetes/pki/etcd/peer.key --cacert=/etc/kubernetes/pki/etcd/ca.crt --endpoints=https://127.0.0.1:2379 member list"

Sometimes this sort of thing helps my learning, but in this case it is was totally frustrating inconvenience. If someone was being vigilant maybe they would catch this. But why does this sort of issue have to exist at all? Would you be able to update these documents?

Comments

  • It seems the ETCDCTL_xxx variables and the 'member list' command are incomptible:

    k -n kube-system exec etcd-k8scp -it -- sh -c \
    'ETCDCTL_API=3 etcdctl member list \
    --cacert="/etc/kubernetes/pki/etcd/ca.crt" \
    --cert="/etc/kubernetes/pki/etcd/server.crt" \
    --key="/etc/kubernetes/pki/etcd/server.key"'
    

    is ok but

    k -n kube-system exec etcd-k8scp -it -- sh -c \
    'ETCDCTL_API=3 \
    ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
    ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
    ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
    etcdctl member list'
    

    isn't. And

    k -n kube-system exec etcd-k8scp -it -- sh -c \
    'ETCDCTL_API=3 \
    ECTDCTL_CACERT=/etc/kubernetes/pki/etcd/ca.crt \
    ECTDCTL_CERT=/etc/kubernetes/pki/etcd/server.crt \
    ECTDCTL_KEY=/etc/kubernetes/pki/etcd/server.key \
    etcdctl endpoint health -w table'
    

    is fine again

  • oleksazhel
    oleksazhel Posts: 57

    @thomas.bucaioni It's because of incorrect spelling of ECTDCTL_CACERT . There must be ETCDCTL_CACERT

  • Hi @oleksazhel then the certificates are not mandatory for the health command, because there was a typo too?

  • oleksazhel
    oleksazhel Posts: 57

    @thomas.bucaioni it doesn't work for health command as well. If you check output you'll find that there is warning and ERROR about context deadline exceeded.

  • @oleksazhel indeed, I must have mistaken the commands. By the way, what happens after the expiration date:

    $ cat /etc/kubernetes/pki/etcd/ca.crt | openssl x509 -noout -enddate
    notAfter=Jun 30 17:26:05 2032 GMT
    

    Does the cluster renew all its certificates itself?

  • oleksazhel
    oleksazhel Posts: 57

    @thomas.bucaioni Let's see in 10 years))

Categories

Upcoming Training