Accessing a remote k3s cluster via Lens IDE

user_16154370 0
Viewed 2277

I was trying to configure a new installation of Lens IDE to work with my remote cluster (on a remote server, on a VM), but encountered some errors and can't find a proper explanation for this case.

Lens expects a config file, I gave it to it from my cluster having it changed from

server: https://127.0.0.1:6443

to

server: https://(address to the remote server):(assigned intermediate port to 6443 of the VM with the cluster)

After which in Lens I'm getting this:

2021/06/14 22:55:13 http: proxy error: x509: certificate is valid for 10.43.0.1, 127.0.0.1, 192.168.1.122, not (address to the remote server)

I can see that some cert has to be reconfigured, but I'm absolutely new to the thing.

Here the full contents of the original config file:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0...
    server: https://127.0.0.1:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    client-certificate-data: LS0...
    client-key-data: LS0...
k3s kubernetes certificate proxy
1 Answers

The solution is quite obvious and easy.

k3s has to add the new IP to the certificate. Since by default, it includes only localhost and the IP of the node it's running on, if you (like me) have some kind of machine in from of it(like an lb or a dedicated firewall), the IP of one has to be added manually.

There are two ways how it can be done:

  1. During the installation of k3s:
curl -sfL https://get.k3s.io | sh -s - server --tls-san desired IP
  1. Or this argument can be added to already installed k3s:
sudo nano /etc/systemd/system/k3s.service

ExecStart=/usr/local/bin/k3s \
    server \
        '--tls-san' \
        'desired IP' \

sudo systemctl daemon-reload

P.S. Although, I have faced issues with the second method.

user_161543700
Related