Channels
academy
amazon
arm
azure
cabpr
chinese
ci-cd
danish
deutsch
developer
elemental
epinio
espanol
events
extensions
fleet
français
gcp
general
harvester
harvester-dev
hobbyfarm
hypper
japanese
k3d
k3os
k3s
k3s-contributor
kim
kubernetes
kubewarden
lima
logging
longhorn-dev
longhorn-storage
masterclass
mesos
mexico
nederlands
neuvector-security
office-hours
one-point-x
onlinemeetup
onlinetraining
opni
os
ozt
phillydotnet
portugues
rancher-desktop
rancher-extensions
rancher-setup
rancher-wrangler
random
rfed_ara
rio
rke
rke2
russian
s3gw
service-mesh
storage
submariner
supermicro-sixsq
swarm
terraform-controller
terraform-provider-rancher2
terraform-provider-rke
theranchcast
training-0110
training-0124
training-0131
training-0207
training-0214
training-1220
ukranian
v16-v21-migration
vsphere
windows
Title
b
broad-petabyte-50341
02/02/2023, 6:29 PMHi all,
I have a situation where I'd like to add a sidecar to the kube-apiserver and this will need to happen after the cluster has been created. Would the proper way to do this be to edit the manifest in
/var/lib/rancher/rke2/agent/pod-manifests/kubectl editc
creamy-pencil-82913
02/02/2023, 6:38 PMthe static pods are managed by RKE2. There is no way to inject additional containers into the control-plane static pods.
you could edit them on disk but they will be regenerated whenever rke2 starts
what specifically are you trying to do with your sidecar?
b
broad-petabyte-50341
02/02/2023, 6:41 PMI have a reverse proxy that I'm trying to put right next to the kube-apiserver to allow me to use kubectl with all ports closed.
so a reverse proxy client
so the only way to make this happen would be to do it before start up?
c
creamy-pencil-82913
02/02/2023, 6:43 PMI mean you could edit the static pods but that is 1) not supported 2) going to be undone every time you restart rke2
other thing running on the node do need the apiserver to actually be accessible, if you lock it down somehow other stuff in the cluster is going to break
why not just deploy your reverse proxy thing as a pod in the cluster that connects to the in-cluster apiserver endpoint? Why would it need to be a sidecar?
Making the apiserver inaccessible is going to break pretty much everything
b
broad-petabyte-50341
02/02/2023, 6:45 PMit would still be internally accessible, would just be closing off anything from outside the cluster
c
creamy-pencil-82913
02/02/2023, 6:45 PMok so just run it as a pod and leave the apiserver alone
if it’s still accessible internally then I don’t understand why it needs to be a sidecar
b
broad-petabyte-50341
02/02/2023, 6:47 PMthat does work, and that's what I've going at the moment, but I'd like to hit the kube-apiserver without using kubedns
c
creamy-pencil-82913
02/02/2023, 6:48 PMthe apiserver is always at the first address in the service IP range, you could rely on that fact, or use the KUBERNETES_SERVICE_HOST environment variable via downwards API… there are a lot of different ways to do what you want without having to hack at the static pod
why don’t you want to use dns?
b
broad-petabyte-50341
02/02/2023, 6:50 PMKUBERNETES_SERVICE_HOSTc
creamy-pencil-82913
02/02/2023, 6:51 PMjust run
envb
broad-petabyte-50341
02/02/2023, 6:51 PMthe problem isn't necessarily DNS, more just getting traffic directly to its destination in as few steps as possible
that's the address of kubeDNS right?
in KUBERNETES_SERVICE_HOST
c
creamy-pencil-82913
02/02/2023, 6:52 PMno, that’s the address of the Kubernetes service
b
broad-petabyte-50341
02/02/2023, 6:53 PMmmmm right right
ok