How turn off the k3s apiserver's verification of the kubelet certificate

[hzyfox]

I want to add some cloud vendors' virtual nodes to my k3s cluster, but these virtual nodes do not have k3s' root certificates, so they cannot obtain the trust of the apiserver. I need to turn off the k3s apiserver's verification of the kubelet certificate. Is there any way to do this? In other words, is there any way I can set --kubelet-certificate-authority to empty?

[brandond]

No, you cannot disable TLS certificate validation between cluster components.

Why would you need to use kubelet serving certs that aren't issued by the k3s root CA? There is no way to get the virtual kubelets to use the cluster CA?

Also note that k3s expects all nodes to be k3s nodes, things may act weird if you have virtual kubelets or kubelets from other Kubernetes distributions.

[hzyfox]

I list /var/lib/rancher/k3s/server/tls, and found

• server-ca.crt: root crt
• server-ca.key root private key
• serving-kubelet.key
  I guess I should use server-ca.crt and server-ca.key and a virtual node csr to generate a certificate for virtual kubelet server right?

[hzyfox]

No, you cannot disable TLS certificate validation between cluster components.

Why would you need to use kubelet serving certs that aren't issued by the k3s root CA? There is no way to get the virtual kubelets to use the cluster CA?

Also note that k3s expects all nodes to be k3s nodes, things may act weird if you have virtual kubelets or kubelets from other Kubernetes distributions.

I list /var/lib/rancher/k3s/server/tls, and found

server-ca.crt: root crt
server-ca.key root private key
serving-kubelet.key
I guess I should use server-ca.crt and server-ca.key and a virtual node csr to generate a certificate for virtual kubelet server right?

[brandond]

It's actually easier than that:

curl -vkS -H 'k3s-Node-Name: k3s-agent-1' -H 'k3s-Node-Password: password' 'https://node:TOKEN@SERVER:6443/v1-k3s/serving-kubelet.crt'
curl -vkS -H 'k3s-Node-Name: k3s-agent-1' -H 'k3s-Node-Password: password' 'https://node:TOKEN@SERVER:6443/v1-k3s/client-kubelet.crt'

This will generate you a cert chain + private key that can be used by the kubelet.

Replace TOKEN with your actual cluster join token. Note that the password for a given node is stored to a secret once used; you must always use the same node password for the same node name, or delete the corresponding node password secret.