From 216a4d0482b00c1b7ce62afe58fb3be128661e01 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Thu, 11 Nov 2021 01:58:55 +0000 Subject: [PATCH 1/3] Update k3s HA install to cover changes with the token --- .../k3s/latest/en/installation/ha/_index.md | 30 +++++++++++++++---- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 00c082d2ac5..4c9b3e564dd 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -33,12 +33,13 @@ You will first need to create an external datastore for the cluster. See the [Cl ### 2. Launch Server Nodes K3s requires two or more server nodes for this HA configuration. See the [Installation Requirements]({{}}/k3s/latest/en/installation/installation-requirements/) guide for minimum machine requirements. -When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. +When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes, when empty this token will be generated automatically for further use. -For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore: +For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and [set a token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): -``` +```bash curl -sfL https://get.k3s.io | sh -s - server \ + --token=SECRET \ --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" ``` @@ -62,12 +63,31 @@ Agent nodes need a URL to register against. This can be the IP or hostname of an This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors in such a configuration, you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname. -### 4. Optional: Join Agent Nodes +### 4. Options: Join Additional Server Nodes + +The same example command in Step 2 can be used to join additional server nodes, where the token from the first node needs to be used. + +If the first server node was started without the `--token` CLI flag or `K3S_TOKEN` variable, the token value can be retrieved from any server already joined to the cluster: +```bash +cat /var/lib/rancher/k3s/server/token +``` + +Additional server nodes can then be added [using the token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): + +```bash +curl -sfL https://get.k3s.io | sh -s - server \ + --token=SECRET \ + --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" +``` + +> **Note:** Ensure that you retain a copy of this token as it is required when restoring from backup and adding nodes. Previously, K3s did not enforce the use of a token when using external SQL datastores. + +### 5. Optional: Join Agent Nodes Because K3s server nodes are schedulable by default, the minimum number of nodes for an HA K3s server cluster is two server nodes and zero agent nodes. To add nodes designated to run your apps and services, join agent nodes to your cluster. Joining agent nodes in an HA cluster is the same as joining agent nodes in a single server cluster. You just need to specify the URL the agent should register to and the token it should use. -``` +```bash K3S_TOKEN=SECRET k3s agent --server https://fixed-registration-address:6443 ``` From 06f5c0f71d625d240fa3e7afc1ef46cc4bf1c817 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Fri, 12 Nov 2021 08:52:17 +1300 Subject: [PATCH 2/3] Update content/k3s/latest/en/installation/ha/_index.md Co-authored-by: Jen Travinski --- content/k3s/latest/en/installation/ha/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 4c9b3e564dd..0fe32453f4f 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -33,7 +33,7 @@ You will first need to create an external datastore for the cluster. See the [Cl ### 2. Launch Server Nodes K3s requires two or more server nodes for this HA configuration. See the [Installation Requirements]({{}}/k3s/latest/en/installation/installation-requirements/) guide for minimum machine requirements. -When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes, when empty this token will be generated automatically for further use. +When running the `k3s server` command on these nodes, you must set the `datastore-endpoint` parameter so that K3s knows how to connect to the external datastore. The `token` parameter can also be used to set a deterministic token when adding nodes. When empty, this token will be generated automatically for further use. For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and [set a token]({{}}/k3s/latest/en/installation/install-options/server-config/#cluster-options}}): From 3e73b9d705d89964db9f07c49b35e80c59d50185 Mon Sep 17 00:00:00 2001 From: dkeightley <20566450+dkeightley@users.noreply.github.com> Date: Thu, 11 Nov 2021 19:54:17 +0000 Subject: [PATCH 3/3] Fix typo --- content/k3s/latest/en/installation/ha/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md index 0fe32453f4f..92886efbe56 100644 --- a/content/k3s/latest/en/installation/ha/_index.md +++ b/content/k3s/latest/en/installation/ha/_index.md @@ -63,7 +63,7 @@ Agent nodes need a URL to register against. This can be the IP or hostname of an This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors in such a configuration, you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname. -### 4. Options: Join Additional Server Nodes +### 4. Optional: Join Additional Server Nodes The same example command in Step 2 can be used to join additional server nodes, where the token from the first node needs to be used.