This message was deleted.
# rke2a
adamant-kite-43734
10/19/2024, 5:22 AMThis message was deleted.
c
creamy-pencil-82913
10/19/2024, 6:02 AMYou're supposed to upgrade it periodically. Or at least restart the services when the certs are within 3 months of expiring so they auto renew
q
quaint-alarm-7893
10/21/2024, 1:34 PMso i have k3's cluster with rancherd, then inside that, i have an rke2 cluster.
quaint-alarm-7893
10/21/2024, 1:34 PMso two questions, 1) do i have to do this for both? 2) what's the "upgrade" process?
quaint-alarm-7893
10/21/2024, 1:35 PMand it's my understanding the restart also happens if you reboot the node correct? if yes, should i just reboot each node once a month or something?
c
creamy-pencil-82913
10/21/2024, 4:54 PMThe cluster is not “inside” rancherd, it is managed by rancher. Certificate rotation is a cluster level operation, so yes they would both need to be restarted to effect the renewal.
creamy-pencil-82913
10/21/2024, 4:54 PMAutomatic renewal happens whenever the service starts, so it’s up to you if you want to reboot the node, or just restart the service.
q
quaint-alarm-7893
10/21/2024, 4:54 PMfollowup. same thing for windows nodes?
c
creamy-pencil-82913
10/21/2024, 4:55 PMwindows nodes are agents and behave the same as linux agents
q
quaint-alarm-7893
10/21/2024, 4:56 PMokay, i know when i did the cert rotation button on the rancher site the windows node threw errors, after looking into it it looks like there's a bug there, but it sounds like i should be able to just bounce that node and it'll renew itself
quaint-alarm-7893
10/21/2024, 4:56 PMthanks!
quaint-alarm-7893
10/21/2024, 4:57 PMi'll see if i can do some of this to revive the nodes that are having issues, see if that fixes it. can you do this after the cert is already expired? or is it too late then?
c
creamy-pencil-82913
10/21/2024, 5:00 PMyou’d need to restart the server nodes first, then the agents.
q
quaint-alarm-7893
10/21/2024, 5:03 PMby server nodes, you mean control-plane / etc / master nodes?
quaint-alarm-7893
10/21/2024, 5:03 PMsorry, running harvester and k3s and rancher and rke2. it's like inception for services. 😄
quaint-alarm-7893
10/21/2024, 5:04 PM(fyi my k3s setup is on proxmox, not harvester)
c
creamy-pencil-82913
10/21/2024, 5:04 PMetcd/control-plane roles are servers, as far as k3s/rke2 are concerned. Other nodes are agents.
q
quaint-alarm-7893
10/21/2024, 5:04 PMmy setup is basically proxmox w/ k3s on it running rancherd
harvester w/ rke2 nodes, and rke2 is managing harvester as well
quaint-alarm-7893
10/21/2024, 5:05 PMgot it. thanks!
quaint-alarm-7893
10/21/2024, 5:05 PMso basically reboot all my master nodes, then agent nodes.
quaint-alarm-7893
10/26/2024, 7:39 PMi setup a customer rke2 cluster with Rancher. it's v1.30.4. on my prior cluster i used v1.26.8
using the default ingress, before i could go to the masternodes ip and get an ssl cert (https://{ip}) but now, i'm not getting a page, i just get a time out. nodes for both clusters have the same taints, the helmchartconfig is the same for ingress. not understanding how before i could go to the ip, and now i cant.
this is mainly an issue because on the cluster i used to run, i had kube-vip which had a floating / vip between the master nodes. i could then use that as my endpoint for ingress, kubeconfig etc and if a node was down, i was still able to access resources on the cluster.
3 Views