https://rancher.com/ logo
Join Slack
Powered by
I'm setting up RKE2 for the first time, and I got ...
# general
s
I'm setting up RKE2 for the first time, and I got this error message when trying to start the rke2-server daemon:
Copy code
level=fatal msg="Failed to reconcile with temporary etcd: failed to normalize server token; must be in format K10<CA-HASH>::<USERNAME>:<PASSWORD> or <PASSWORD>"
In /etc/rancher/rke2/config.yaml I've specified both agent-token and token using the output of rke2 token generate (ran it twice), which produced tokens in [a-z0-9]{6}.[a-z0-9]{16} format. What am I doing wrong here?
c
You can't do that.
That format is reserved for only agent bootstrap tokens, which are stored as secrets within the cluster.
s
Yeah I looked at the documentation, and it gives no indication what the format is
c
Just use a random string that does not match the [a-z0-9]{6}.[a-z0-9]{16} pattern that is reserved for agent bootstrap tokens
s
But Claude just told me to use openssl rand -hex 32
c
There is no format. It's just a password.
Yes that would work as a good way to generate a random string
s
I mean surely there's character or length restrictions?
Both https://docs.rke2.io/reference/server_config and https://docs.rke2.io/reference/linux_agent_config offer zero guidance other than "Shared secret used to join agents to the cluster, but not servers" or "Token to use for authentication"
c
it is literally just setting the password that is used for http basic auth, as described in step 5 of the list here: https://docs.rke2.io/security/token#tls-bootstrapping
s
Yeah I looked at that, but again it gives no indication what the format is.
To give you some more context of what I'm trying to do. I'm trying to use Salt (an automation platform) bootstrap an RKE2/Rancher cluster. So I need to be able to determine all the required values/secrets in advance.
And if you scroll further down that page to the RKE token CLI,
Copy code
Create a new bootstrap token. The [token] is the actual token to write, as generated by rke2 token generate. If no token is given, a random one will be generated.
So what I used was the output of rke2 token generate, so perhaps you can understand my confusion over the format.
c
those are specifically for the Bootstrap tokens. You are reading the bootstrap token section of the docs, but then trying to use those tokens as the Server and Agent tokens.
https://docs.rke2.io/security/token#token-types Type CLI Option Environment Variable Server --token RKE2_TOKEN Agent --agent-token RKE2_AGENT_TOKEN Bootstrap n/a n/a
The table clearly shows that there are three different types of tokens. And the docs say 
rke2 token create [token]
Create a new bootstrap token
It does not say “create a new server or agent token”. It says bootstrap token.
s
Yeah I guess I just don't have enough experience with RKE2 to understand all the nuances, but I do stand by my assertion that there's no (or not enough) guidance of what should be in agent-token or token in config.yaml. However, I do thank you for all your help, as I've managed to get a couple server nodes up now. It is genuinely appreciated.
(End goal is 2 LB nodes [haproxy/keepalived], 3 server nodes and 4 agent nodes)
c
I will see if there is some change we can make to the docs to make it more clear what user-provided server and agent tokens should look like
s
I think that'd be helpful. Even just a note like "agent-token should be a random string at least 32 characters long" or something
c
there isn’t a specific length requirement, it can be one character or it can be 1000, just as long as its not empty and doesn’t exceed the http max header size
and there are some character restrictions since it’s stored to disk in csv format. so that would be good to document. But in general, just any alphanumeric string of medium length should suffice
s
yeah but I'm sure some guidance on best practices would be helpful
"We suggest an alphanumeric string of at least x characters" or something
Since someone starting out won't have any idea what the value/tradeoffs/pitfalls of using a 8 character numeric string vs a 1024 character alpha-numeric-special-chars string is.
148 Views
Open in Slack
PreviousNext
Powered by