How does RKE2 connect to the API server?

This article is a mirror of https://jsty.tistory.com/326
There may be updates to the original article.




Kubernetes' kubelet communicates with kube-apiserver. So, if there are multiple control plane nodes, need to create a Domain or VIP and implement it so that it can be connected to a live Control Plane node through a Load Balancer.

However, I installed RKE2 as Elemental, but I had a problem. This is because there was no way to set up such a Load Balancer.

(If you just install RKE2, you can set the server address, but if you provision with elemental and rancher, it will be configured automatically)

So if the first provisioned control plane node dies, how do other nodes communicate? I asked RKE2 Slack.
> https://rancher-users.slack.com/archives/C3ASABBD1/p1666656986435839









According to the above, even if Rancher dies, the provisioned cluster operates alone, and after Node Join, the address of the control node becomes caching for all nodes, so that the load balances itself.
And, if the IP of the control plane changes, the cache also seems to change.








댓글

댓글 쓰기

이 블로그의 인기 게시물

Fix "go get" error "invalid char ':'" when using custom-port.

Korean:  https://jsty.tistory.com/334  We are running gitlab on a non-standard port. A problem occurred recently when I tried to use the go package through the gitlab repository. $ go get https://gitlab.company.com:1234/group/pkg-name go: malformed module path "https:/gitlab.company.com:1234/group/pkg-name": invalid char ':' Related issues: - https://github.com/golang/go/issues/26912 - https://stackoverflow.com/questions/60445266/not-able-to-get-private-go-module-while-having-port-number-in-url I developed a simple service to solve this. It simply generates metadata to find the actual repository. See https://github.com/jc-lab/go-pkg-meta-proxy/
자세한 내용 보기

EJBCA-CE Docker with HSM on Kubernetes

This article is a mirror of https://jsty.tistory.com/324 There may be updates to the original article. ejbca-ee can be integrated with HSM. >  https://github.com/Keyfactor/ejbca-containers/blob/master/hsm-integration/hsm-drivers/hsm-driver-softhsm/Containerfile However, registry.primekey.com is not accessible as it is a paid repository. So, I implement it using the open source pkcs11-proxy. See https://gist.github.com/jclab-joseph/973d06db6856a8e5cb851909fbc7268b And  https://github.com/jc-lab/hsm-driver-opensc hsm-driver-opensc originally tried to implement opensc but failed and replaced it with pkcs11-proxy.
자세한 내용 보기

EJBCA: "no such algorithm" error when using PKCS11.

I used pkcs11-proxy for EJBCA-CE, but the signature didn't work. 2022-10-26 10:18:14,995+0000 ERROR [org.cesecore.certificates.certificate.CertificateCreateSessionBean] (default task-4) Error creating certificate: org.bouncycastle.operator.OperatorCreationException: cannot create signer: no such algorithm: SHA512WITHRSA for provider SunPKCS11-p11proxy-client.so-slot0 at deployment.ejbca.ear//org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.build(Unknown Source) at deployment.ejbca.ear//org.cesecore.certificates.ca.X509CAImpl.generateCertificate(X509CAImpl.java:1698) at deployment.ejbca.ear//org.cesecore.certificates.ca.X509CAImpl.generateCertificate(X509CAImpl.java:1117) at deployment.ejbca.ear.cesecore-ejb.jar//org.cesecore.certificates.certificate.CertificateCreateSessionBean.createCertificate(CertificateCreateSessionBean.java:563) at deployment.ejbca.ear.cesecore-ejb.jar//org.cesecore.certificates.certificate.CertificateCreate
자세한 내용 보기