Unable to connect worker node to master using K3S

Viewed 856

I am trying to setup a K3S cluster for learning purposes but I am having trouble connecting the master node with agents. I have looked several tutorials and discussions on this but I can't find a solution. I know I am probably missing something obvious (due to my lack of knowledge), but still help would be much appreciated.

I am using two AWS t2.micro instances with default configuration.

When ssh into the master and installed K3S using

curl -sfL https://get.k3s.io | sh -s - --no-deploy traefik --write-kubeconfig-mode 644 --node-name k3s-master-01

with kubectl get nodes, I am able to see the master

NAME            STATUS   ROLES                  AGE   VERSION
k3s-master-01   Ready    control-plane,master   13s   v1.23.6+k3s1

So far it seems I am doing things right. From what I understand, I am supposed to configure the kubeconfig file. So, I accessed it by using

cat /etc/rancher/k3s/k3s.yaml

I copied the configuration file and the server info to match the private IP I took from AWS console, resulting in something like this

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <lots_of_info>
    server: https://<master_private_IP>:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    client-certificate-data: <my_certificate_data>
    client-key-data: <my_key_data>

Then, I ran vi ~/.kube/config, and there I pasted the kubeconfig file

Finally, I grabbed the token with cat /var/lib/rancher/k3s/server/node-token, ssh into the other machine and then run the following

curl -sfL https://get.k3s.io | K3S_NODE_NAME=k3s-worker-01 K3S_URL=https://<master_private_IP>:6443 K3S_TOKEN=<master_token> sh -

The output is

[INFO]  Finding release for channel stable
[INFO]  Using v1.23.6+k3s1 as release
[INFO]  Downloading hash https://github.com/k3s-io/k3s/releases/download/v1.23.6+k3s1/sha256sum-amd64.txt
[INFO]  Downloading binary https://github.com/k3s-io/k3s/releases/download/v1.23.6+k3s1/k3s
[INFO]  Verifying binary download
[INFO]  Installing k3s to /usr/local/bin/k3s
[INFO]  Skipping installation of SELinux RPM
[INFO]  Creating /usr/local/bin/kubectl symlink to k3s
[INFO]  Creating /usr/local/bin/crictl symlink to k3s
[INFO]  Creating /usr/local/bin/ctr symlink to k3s
[INFO]  Creating killall script /usr/local/bin/k3s-killall.sh
[INFO]  Creating uninstall script /usr/local/bin/k3s-agent-uninstall.sh
[INFO]  env: Creating environment file /etc/systemd/system/k3s-agent.service.env
[INFO]  systemd: Creating service file /etc/systemd/system/k3s-agent.service
[INFO]  systemd: Enabling k3s-agent unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s-agent.service → /etc/systemd/system/k3s-agent.service.
[INFO]  systemd: Starting k3s-agent

By this output, it looks like I have created an agent. However, when I run kubectl get nodes in the master, I still get

NAME            STATUS   ROLES                  AGE   VERSION
k3s-master-01   Ready    control-plane,master   12m   v1.23.6+k3s1

What is the thing I was supposed to do in order to get the agent connected to the master? I am guess I am probably missing something simple, but I just can't seem to find the solution. I've read all the documentation but it is still not clear to me where I am making the mistake. I've tried saving the private master IP and token into the agent as environmental variables with export K3S_TOKEN=master_token and K3S_URL=master_private_IP and then simply running curl -sfL https://get.k3s.io | sh - but I still can't see the worker nodes when running kubectl get nodes

Any help would be appreciated.

1 Answers

It might be your VM instance firewall that prevents appropriate connection from your master to the worker node (and vice versa). Official rancher documentation advise to disable firewall for (Red Hat/CentOS) Enterprise Linux:

  1. It is recommended to turn off firewalld:
systemctl disable firewalld --now
  1. If enabled, it is required to disable nm-cloud-setup and reboot the node:
systemctl disable nm-cloud-setup.service nm-cloud-setup.timer reboot

If you are using Ubuntu on your VM's, there is a different firewall tool (ufw). In my case, allowing 6443 and 443(not sure if required) port TCP connections worked fine.

  1. Allow port 6443 and TCP connection in all of your cluster machines:
sudo ufw allow 6443/tcp

Then apply k3s installation script in your worker node(s):

curl -sfL https://get.k3s.io | K3S_NODE_NAME=k3s-worker-1 K3S_URL=https://<k3s-master-1 IP>:6443 K3S_TOKEN=<k3s-master-1 TOKEN> sh -

This should work. If not, you can try adding additional allow rule for 443 tcp port as well.

Related