1) AWS public IPs are dynamic. To make sure the public IP is added to the API server's TLS certs, I have to query the metadata service on startup before k3s starts, then override the ExecStart of the k3s systemd service with a drop-in. Or at least, that's what I'm doing -- is there a simpler way?

2) For users' kubeconfigs, I have a oneshot unit that starts after k3s starts and writes a modified copy of the kubeconfig to the ec2-user home directory, with the

server

set to the public DNS of the API server. This feels not great -- I don't want to edit

/etc/rancher/k3s/k3s.yaml

because then that would put cluster-local things through the external IP, and I don't love writing a copy of the admin kubeconfig to a user home directory, but I don't want users to have to hand-edit the kubeconfig after they download it. What are other folks doing to automate this?

For public IPs I am deploying EIPs with each server then I grab the EIP before installing rke2. For TLS I pre-deploy a public subnet for each availability zone and assign them to the load balancer, then I assign the load balancer's IPs to the domain and get certs for the domain.

Feel free to put any more questions you have in the #C07M052K9D0 channel.