[BUG] kubectl won't connect #423
Comments
|
After looking into the logs, I saw that k3s is not able to pull the images. It seems that the server container is not using the proxy settings from my Docker configuration. I'll now try to get my proxy settings into the server container. There are two possibilities: either specify env variable with k3d or look why my docker configuration is ignored. Maybe K3D runs docker commands as another user. Edit: ➜ ~ docker inspect ad4b0e18c8e6 |
|
Okay, after setting the proxy settings via I first thought that K3S probably didn't start but I logged into the container of the server with docker exec and used kubectl there. And it worked: So why, is my service lb not able to connect to K3S. Running So I logged into my lb container and install ncat. I already ran a ping test towards my k3s container, which worked, now I tried to establish a TCP connection using |
|
So the final solution to this problem is to not forget to add the new bridge connector, K3D creates, to the trusted zone of your firewall. On fedora running I'm not sure if you consider this works as intended but I think it would be nice if I would have gotten a reminder to configure the firewall. |
|
Hi @Ka0o0 , thanks for opening this issue and doing all the research!
|
|
As I just found out, it's actually not specific to Fedora. All Linux OSs using nftables have this problem. The problem is also described here: https://fedoraproject.org/wiki/Changes/firewalld_default_to_nftables#Scope Now in terms of usability: The thing is, that most of the time I don't need to care about the firewalld settings as I rarely use the bridge functionality. But K3D does under the hood create bridges, so maybe it could be checked if nftables was activated and if so, it could print a warning or a reminder to add the new bridge as a trusted network? |
|
Thanks for your investigations here @Ka0o0 ! |
iwilltry42
added
help wanted
|
I found it! The thing that tipped this into being functional was adding 0.0.0.0 to my NO_PROXY env. Currently I have: For reference: As I understand things the 10.0.0.0/8 and 0.0.0.0 are the once most likely needed for k3d. I also pass in a k3s_registry.yml that looks something like: (Obviously the above should be adjusted for your endpoints). to create the cluster I used: I didn't need to pass -e HTTP_PROXY -e NO_PROXY (though maybe these might be useful later?). The root issue was that kubectl was hitting the proxy server for 0.0.0.0 when it shouldn't have been. |
Hi,
I was trying to create a new cluster and connect via kubectl to it.
I'm running on Fedora and I first had to figure out that I needed to specify the(edit: found #339 but issue still exists)--api-port 127.0.0.1:6443because Fedora would not allow any connection to0.0.0.0.I'm still not sure what I'm doing wrong. Any suggestions?
Edit:
Here is the output of
docker logsof the server container: server_log.txtWhat did you do
How was the cluster created?
k3d cluster create -a 1 --api-port 127.0.0.1:6443What did you do afterwards?
k3d kubeconfig merge k3s-default --switch-context --overwritekubectl get pods -AHere the kubectl get pods -A will timeout with the following error:
What did you expect to happen
See the output of kubectl.
Screenshots or terminal output
Which OS & Architecture
Which version of
k3dWhich version of docker
The text was updated successfully, but these errors were encountered: