This message was deleted.

its a boolean flag, all of these are correct: https://github.com/k3s-io/k3s/blob/a693071c74688db1cc3330748f1a98f5321ffcd4/pkg/cli/cmds/server.go#L499-L503

INSTALL_K3S_EXEC="--secrets-encryption true"

this command fails executing as far as I can tell.

yeah, it is in effect not properly encoded, thus this statement: https://rancher-users.slack.com/archives/CGGQEHPPW/p1655923560218969?thread_ts=1655887540.664749&cid=CGGQEHPPW

So basically for booleans I am good to go with

INSTALL_K3S_EXEC="--secrets-encryption"

just setting them like this right?

that said, consider leveraging the

/etc/rancher/k3s/config.yaml

for an overall better configuration experience

export INSTALL_K3S_EXEC="--kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log' --kube-apiserver-arg='audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'"

What about passing strings like this inside the env variable?

should work iirc, but it depends on how you are getting the envvar to the install script

/etc/rancher/k3s/config.yaml

I have no idea how to write all these commands into the yaml file. The docs only shows two simple examples.

can you link me the doc you are using?

https://rancher.com/docs/k3s/latest/en/installation/install-options/#configuration-file ?

yes that one

yeah i see what you mean. you kind of have to know the internal type used for args though iirc the parsing does try to be forgiving (particularly with string arrays)

ok so for integer and booleans I should not use "", and rest of it just wrap around double quotes right?

yeah that should get your most of the way with even complex config

No, your solution is far better but I am trying to implement the k3s CIS hardening parameters also and am confused how to properly implement those things. K3S is not giving me any error if it is not parsing any parameters also. So very hard to debug what is getting ignored from my INSTALL_K3S_EXEC list.

ah, well for that, worst case is you can inspect what k3s thinks the runtime config is by inspecting the node annotations

<http://k3s.io/node-args|k3s.io/node-args>

and

<http://k3s.io/node-env|k3s.io/node-env>

got it. thanks a lot for the info. am trying to create the yaml then. better to visualize and manage.

anyhow, while i no longer work for suse/rancher i was a dev on this project and hope i have been helpful. if you are still stuck please do ping me here (i'm gonna switch to a diff screen. if i am unresponsive try tagging me)

Thanks a lot for the help. Really appreciate it. I will let you know how it goes.