Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you may not be able to execute some actions.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

error: error loading config file "/etc/rancher/k3s/k3s.yaml": open /etc/rancher/k3s/k3s.yaml: permission denied

esther

When I run commands under k3s kubectl, I get

$ k3s kubectl version
WARN[0000] Unable to read /etc/rancher/k3s/k3s.yaml, please start server with --write-kubeconfig-mode to modify kube config permissions 
error: error loading config file "/etc/rancher/k3s/k3s.yaml" : open /etc/rancher/k3s/k3s.yaml: permission denied

How should I resolve this? Should I change the permissions of /etc/rancher/k3s/k3s.yaml

P
Pearlaqua last edited by
No, do not change permissions of /etc/rancher/k3s/k3s.yaml

First set up your an environmental variable for KUBECONFIG=~/.kube/config.
```
export KUBECONFIG=~/.kube/config
```
Then let's generate the file at that location. https://github.com/k3s-io/k3s/issues/389 . This is by-design. It should be owned by root and set to 0600. Instead copy the config locally as https://devops.stackexchange.com/a/16014/18965 ,
```
mkdir ~/.kube 2> /dev/null
sudo k3s kubectl config view --raw > "$KUBECONFIG"
chmod 600 "$KUBECONFIG"
```
You can add KUBECONFIG=~/.kube/config to your ~/.profile or ~/.bashrc to make it persist on reboot.
Reply Quote 0
1 Reply Last reply

2
Posts

0
Views

Suggested Topics

J

One time/set up jobs on gitlab ci?
Continuous Integration and Delivery (CI, CD) • kubernetes gitlab ci runner • • Jolied

2

0
Votes

2
Posts

1
Views

I dealt with the same issue. Some people recommended using the Gitlab group "secrets" and using before_script. Since I knew I was also going to deploy and would need other tools on my runner like "helm", I made my own docker container. I still keep my config for my clusters in a base64 encoded group secret but I set it like this in the dockerfile. ENV kube_config=$kube_config RUN echo -n ${kube_config} | base64 -d > ~/.kube/config Now just set an environment variable for your gitlab runner to point to your new image. KUBERNETES_IMAGE: registry.gitlab.com/MY_USERNAME/MY_REPO_NAME/MY_IMAGE_NAME:latest Don't forget to test your new container! stages: - build - test - release variables: CONTAINER_TEST_IMAGE: $CI_REGISTRY_IMAGE/gitlab_runner:$CI_COMMIT_REF_NAME CONTAINER_RELEASE_IMAGE: $CI_REGISTRY_IMAGE/gitlab_runner:latest before_script: - apt-get update && apt-get install docker.io -y - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY Build Image: stage: build script: - docker build --build-arg kube_config=${kube_config} -t ${CONTAINER_TEST_IMAGE} . - docker push ${CONTAINER_TEST_IMAGE} except: - master Test Kubectl: stage: test script: - docker pull ${CONTAINER_TEST_IMAGE} - docker run --rm ${CONTAINER_TEST_IMAGE} kubectl get deployments -n kube-system except: - master Test Helm: stage: test script: - docker pull ${CONTAINER_TEST_IMAGE} - docker run --rm ${CONTAINER_TEST_IMAGE} helm ls except: - master Test Docker: stage: test script: - docker pull ${CONTAINER_TEST_IMAGE} - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock ${CONTAINER_TEST_IMAGE} docker images except: - master release-image: stage: release script: - docker pull $CONTAINER_TEST_IMAGE - docker tag $CONTAINER_TEST_IMAGE $CONTAINER_RELEASE_IMAGE - docker push $CONTAINER_RELEASE_IMAGE only: - master Edit: Missed this part.. I'm using a shell runner. So post of what I said is probably not relevant. How ever I do think there is some advantages to building and deploying with a gitlab runner directly on a cluster.
T

Does /etc/rancher/k3s/registries.yaml affect `k3s ctr` and `k3s crictl`?
Continuous Integration and Delivery (CI, CD) • authentication configuration k3s containerd cri • • terrea

2

0
Votes

2
Posts

0
Views

J

This is the answer I got from https://webpros.slack.com/archives/C02T5F4PFJ7/p1641935253158000 ctr and crictl both interact with containerd, via different apis. ctr uses the containerd native api, and crictl uses the CRI api. The registries.yaml config is used by containerd itself, and will be honored no matter what it is that does the pull or how.
M

GitLab Container Registry: errors: denied: requested access to the resource is denied [...] error parsing HTTP 401 response body
Continuous Integration and Delivery (CI, CD) • docker gitlab podman • • magpie

2

0
Votes

2
Posts

0
Views

A personal access token to push to the registry does not just require write_registry but ALSO read_registry or read_api (more general).
E

Pros/cons of discontinuing a DevOps workflow?
Continuous Integration and Delivery (CI, CD) • process operating model • • emran

2

0
Votes

2
Posts

1
Views

M

It's not a good idea. In my experience you'll gain the disadvantages of both while any projected advantages will somehow fail to materialize. Itemized: You will lose speed. IT will comply with their own standard. The new task (for them) will follow the same 'sluggish' template all their work now has. Be prepared they will find it challenging - so even less speed than standard simple actions. You will fail to offload. IT will lean on you guys for every single anomaly. You will put in effort to get one guy up to speed - and the next thing you now you'll be repeating yourself because the following task/problem/day there will be a new guy, again. Documentation will be required, but it will not help. Again template behaviour will be that short manuals will fail to catch every anomaly, and thorough texts will not be read for being too long. So any investment here will be a loss, likewise the enormous effort needed to implement improvements to get your tools to 'shrink-wrapped'quality. Last but not least any problems will reflect on you guys. Tar, tarbrush principle. If the above sounds cynical, well, I'm afraid I've been there. Repeatedly. What to do instead? Go shopping in the IT department, find yourself a useful candidate, and keep this guy 'on loan' to relieve you workload.
J

default backend - 404
Continuous Integration and Delivery (CI, CD) • ingress rancher • • juvenalb

2

0
Votes

2
Posts

0
Views

G

Apparently - I forgot annotations and ingressclass: I first added this: apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: annotations: ingressclass.kubernetes.io/is-default-class: "true" generation: 1 labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: haproxy app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: haproxy-ingress-controller name: haproxy spec: controller: haproxy.org/ingress-controller And in the ingress: apiVersion: extensions/v1beta1 kind: Ingress metadata: name: notesncrap annotations: kubernetes.io/ingress.class: "haproxy" generation: 1 spec: rules: - host: k8scrap.selea.se http: paths: - path: / backend: serviceName: notesncrap servicePort: 80 Please observe the annotation.
Kubernetes multi cloud
Continuous Integration and Delivery (CI, CD) • kubernetes rancher • • Bogopo

2

0
Votes

2
Posts

1
Views

(Rancher employee) Kubernetes itself is really not meant for that use-case. A cluster is generally a set of machines in the same provider with close proximity (latency) to each other. Etcd (and therefore API/CLI/UI/scheduling/everything) performance depends heavily on the (worst-case) latency between all members. Only one cloud-provider integration (storage providers, L4 load balancers) can be configured and most assume nodes are all in the same "region" or similar concept. Commonly used network plugins assume adjacency and/or provide no encryption or authentication suitable for communicating across untrusted networks/the internet. Communication between pods/services within the cluster has no consideration for where the "nearest" place to reach a pod for that service is, so latency from a pod to another service can be large (however far apart the two worst nodes are) and unpredictable (sometimes close, sometimes far). (There is an option for nodePorts to always go to a local pod, but if there is no local pod it will just get dropped). You can make a "custom" cluster and add nodes from wherever and do what you're asking in Rancher, but you're not going to have a good time (no matter what product is building the cluster).
Y

Where can I find the default arguments supplied to the internal Kublet Service in k3s?
Continuous Integration and Delivery (CI, CD) • k3s kubelet • • yajahira

2

0
Votes

2
Posts

0
Views

R

I wasn't able to find them documented, but I did find them in the https://github.com/k3s-io/k3s/blob/491aa11e1068cc6605598822dc456ef1fc18f4f1/pkg/daemons/agent/agent_linux.go#L67 (note there are difference options for https://github.com/k3s-io/k3s/blob/491aa11e1068cc6605598822dc456ef1fc18f4f1/pkg/daemons/agent/agent_windows.go#L59 ) You can see them here, argsMap := map[string]string{ "healthz-bind-address": bindAddress, "read-only-port": "0", "cluster-domain": cfg.ClusterDomain, "kubeconfig": cfg.KubeConfigKubelet, "eviction-hard": "imagefs.available
J

port forward ssh from traefik reverse proxy on docker to a k3s container
Continuous Integration and Delivery (CI, CD) • docker kubernetes k3s traefik • • jonetta

2

0
Votes

2
Posts

2
Views

M

Your ip show does mention 10.42.0.0/32, 10.42.0.200/32. No traces of 10.42.0.232, though. From LAN/outside SDN: can you connect any TCP port, or ping that address? anything that answers? I suspect nothing would. In addition to that Traefik rule, you mentioned creating a Service ... Are you sure you did it right? Look at kubectl get svc -A | grep 10.42.0.200, that would give you a working example -- something with an externalIP/externalIPs set, or some status.loadbalancer.ingress array ... configuration may vary, depending on how external IPs were implemented and kube version, .. And by the way, creating such Services: are you pointing to your application directly, or is it sent to Traefik instead? Assuming the latter: are you sure Traefik actually listens on such port. Also, while Traefik should be able to process TCP or UDP trafic, unless you can easily have several Services & backends accessible through the same proto/port combination: involving your ingress controller here might not be necessary.
R

Measure service unavailability during upgrade
Continuous Integration and Delivery (CI, CD) • upgrade high availability microservices rancher • • rosemadder

2

0
Votes

2
Posts

1
Views

What you suggest might be the simplest way to collect the data, but you will have to do quite a bit of work to extract the availability over certain periods. I think it's fair to say that if you want availability, you need a monitoring system. This means having an extra service in your catalogue to continuously probe the availability of your microservices over time. Storing them in a time-series database would allow you to make queries to establish availability over various periods. There are many tools which could do this for you. A good starting place would be the CNCF monitoring landscape
S

Git Repository Manager conditionally deny pull request
Continuous Integration and Delivery (CI, CD) • git repository • • shizuka

2

0
Votes

2
Posts

1
Views

R

Most repository managers have some way of implementing this. GitHub (and GitHub Enterprise) has the idea of statuses on a commit; you'd set up a webhook that pings your tool's webserver when a commit is pushed, and then it would use the status API to set whether or not it passes the version check. Bitbucket, when self-hosted, supports plugins to integrate nicely with it, including ScriptRunner, which can be used to do all sorts of things similar to what you want. I'm not familiar with GitLab, but it probably has some similar method. You will need to do some programming to implement the checking logic, but these pieces should allow you to kick that off when appropriate and use the results to block the merge.
D

jar file is not displaying in docker container
Continuous Integration and Delivery (CI, CD) • docker dockerfile • • Duquan

2

0
Votes

2
Posts

1
Views

R

You are using docker wrongly in this case IMHO and I have a serious doubt that your docker exec command is targeting the correct container because, from what I see (and my very limited knowledge of sbt/scala), it should be dead by the time the jar is published. Let me explain. sbt publishLocal is not a long living command. It will exit when the jar is published to the local .ivy store on disk. So when you launch a container from your image in foreground with docker run --name mytestcontainer myproject:v1 (I added a name for easier debugging purpose on your side...), I am pretty sure you see all your above logs and that the command exits back to your shell. At this point, if you issue a docker ps, your mytestcontainer will not show up, unless with docker ps -awhere it will be listed in the exited container. If you try to start it again (docker start mytestcontainer), it will exit as soon as the jar is re-compiled/published. So there is no way to target an exec on this container since it is not running. The only way to have a shell in a running container out of this image is to override the start command in docker run but this will bypass your jar publication. Now, what you first want is to publish the jar as part of the image, not to compile/publish it everytime you start a container out of the image. FROM hseeberger/scala-sbt:11.0.2_2.12.8_1.2.8 MAINTAINER Sara Waheed <sarawaheed3191@gmail.com> WORKDIR /myproject ADD . /myproject RUN sbt publishLocal In this case, the jar will be published during the build docker build -t myproject:v1 You can then run a container out of your image dropping to jshell as intended by the base image you are using: docker run -it --rm --name testcontainer myproject:v1 May 12, 2019 8:31:33 AM java.util.prefs.FileSystemPreferences$1 run INFO: Created user preferences directory. | Welcome to JShell -- Version 11.0.2 | For an introduction type: /help intro jshell> Or if you want a more classic bash shell, you can override the start command: docker run -it --rm --name testcontainer myproject:v1 /bin/bash To go further, if your intent is to deliver your application in a ready to use image, you should have a look at Docker multistage builds. The idea is to build your jar in an image containing all the needed build tools and to copy the produced artifacts to an other image intended only for run that you will finally distribute. Here is the basic idea from your example. Image/command used are solely for illustration purpose and the process is highly perfectible (e.g. harcoded version....): FROM hseeberger/scala-sbt:11.0.2_2.12.8_1.2.8 as build WORKDIR /myproject ADD . /myproject RUN sbt publishLocal FROM openjdk:8-alpine WORKDIR /myproject COPY --from=build /root/.ivy2/local/com.test/myproject/1.0.1/jars/myproject.jar . CMD['java', '-jar', 'myproject.jar']
Rancher & gitlab-runner - is there a way to get the gitlab-runner to tell Rancher to start the CI test environment instead?
Continuous Integration and Delivery (CI, CD) • docker gitlab rancher • • Alberto

2

0
Votes

2
Posts

1
Views

T

The short answer is "it depends". Rancher itself runs using system-docker and the docker instances it starts for you, such as gitlab-runner are run separately in regular docker. Gitlab-runner then will start runners depending on its configuration: There are three methods to enable the use of... docker run during jobs; each with their own tradeoffs. https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#runner-configuration My eventual solution I'd initially installed Rancher 1.6 and just couldn't get the dependencies working (Rancher OS running Rancher 1.6 and Rancher agent running on a couple of Alpine nodes). The upgrade to Rancher v2 was a steep learning curve as you need to learn the Kubernetes ecosystem tooling (helm, kubectl, etc). I still couldn't get a gitlab-runner working under Rancher v2, but upgrading to v2.0.8 fixed it. I could add the custom helm chart for gitlab-runner and after cribbing the settings from https://gitlab.com/charts/gitlab-runner/blob/master/values.yaml I could get gitlab-runner working under Rancher v2.
P

Why do some components vanish from the catalog list if one component has been installed in Rancher?
Continuous Integration and Delivery (CI, CD) • rancher • • Pearlaqua

2

0
Votes

2
Posts

1
Views

A

You haven't specified anything concrete, so I can't give you a specific reason... But catalog items can: Be mutually exclusive (e.g. you can't use ipsec and vxlan at the same time) Be deployed at most once in an environment Require the environment be a specific orchestration type Require a certain range of Rancher versions etc
K

Can the status be running after applying the yaml file?
Continuous Integration and Delivery (CI, CD) • kubernetes • • kalyn

2

0
Votes

2
Posts

0
Views

N

Running means that container(s) in your Pod is/are not crashed. Entrypoint started, and command is still running. Creating that yaml (assuming we fixed case / caps characters aren't at the right place, ...). Pod will be Running. Why: because process has no reason to crash. Because if I inspect that image it uses, entrypoint/cmd is just some /bin/sh -c /bin/sh. Shell will start and keep running.
Error: Error creating openstack_compute_floatingip_associate_v2
Continuous Integration and Delivery (CI, CD) • terraform openstack • • jeanid

2

0
Votes

2
Posts

0
Views

C

For me, this ended up being because my system administrator disabled Floating IPs. I was getting the same error in OpenStack Horizons (the web interface).

error: error loading config file "/etc/rancher/k3s/k3s.yaml": open /etc/rancher/k3s/k3s.yaml: permission denied

No, do not change permissions of /etc/rancher/k3s/k3s.yaml

Suggested Topics

One time/set up jobs on gitlab ci? Continuous Integration and Delivery (CI, CD) • kubernetes gitlab ci runner • • Jolied

Does /etc/rancher/k3s/registries.yaml affect `k3s ctr` and `k3s crictl`? Continuous Integration and Delivery (CI, CD) • authentication configuration k3s containerd cri • • terrea

GitLab Container Registry: errors: denied: requested access to the resource is denied [...] error parsing HTTP 401 response body Continuous Integration and Delivery (CI, CD) • docker gitlab podman • • magpie

Pros/cons of discontinuing a DevOps workflow? Continuous Integration and Delivery (CI, CD) • process operating model • • emran

default backend - 404 Continuous Integration and Delivery (CI, CD) • ingress rancher • • juvenalb

Kubernetes multi cloud Continuous Integration and Delivery (CI, CD) • kubernetes rancher • • Bogopo

Where can I find the default arguments supplied to the internal Kublet Service in k3s? Continuous Integration and Delivery (CI, CD) • k3s kubelet • • yajahira

port forward ssh from traefik reverse proxy on docker to a k3s container Continuous Integration and Delivery (CI, CD) • docker kubernetes k3s traefik • • jonetta

Measure service unavailability during upgrade Continuous Integration and Delivery (CI, CD) • upgrade high availability microservices rancher • • rosemadder

Git Repository Manager conditionally deny pull request Continuous Integration and Delivery (CI, CD) • git repository • • shizuka

jar file is not displaying in docker container Continuous Integration and Delivery (CI, CD) • docker dockerfile • • Duquan

Rancher & gitlab-runner - is there a way to get the gitlab-runner to tell Rancher to start the CI test environment instead? Continuous Integration and Delivery (CI, CD) • docker gitlab rancher • • Alberto

Why do some components vanish from the catalog list if one component has been installed in Rancher? Continuous Integration and Delivery (CI, CD) • rancher • • Pearlaqua

Can the status be running after applying the yaml file? Continuous Integration and Delivery (CI, CD) • kubernetes • • kalyn

Error: Error creating openstack_compute_floatingip_associate_v2 Continuous Integration and Delivery (CI, CD) • terraform openstack • • jeanid

No, do not change permissions of `/etc/rancher/k3s/k3s.yaml`

One time/set up jobs on gitlab ci?
Continuous Integration and Delivery (CI, CD) • kubernetes gitlab ci runner • • Jolied

Does /etc/rancher/k3s/registries.yaml affect `k3s ctr` and `k3s crictl`?
Continuous Integration and Delivery (CI, CD) • authentication configuration k3s containerd cri • • terrea

GitLab Container Registry: errors: denied: requested access to the resource is denied [...] error parsing HTTP 401 response body
Continuous Integration and Delivery (CI, CD) • docker gitlab podman • • magpie

Pros/cons of discontinuing a DevOps workflow?
Continuous Integration and Delivery (CI, CD) • process operating model • • emran

default backend - 404
Continuous Integration and Delivery (CI, CD) • ingress rancher • • juvenalb

Kubernetes multi cloud
Continuous Integration and Delivery (CI, CD) • kubernetes rancher • • Bogopo

Where can I find the default arguments supplied to the internal Kublet Service in k3s?
Continuous Integration and Delivery (CI, CD) • k3s kubelet • • yajahira

port forward ssh from traefik reverse proxy on docker to a k3s container
Continuous Integration and Delivery (CI, CD) • docker kubernetes k3s traefik • • jonetta

Measure service unavailability during upgrade
Continuous Integration and Delivery (CI, CD) • upgrade high availability microservices rancher • • rosemadder

Git Repository Manager conditionally deny pull request
Continuous Integration and Delivery (CI, CD) • git repository • • shizuka

jar file is not displaying in docker container
Continuous Integration and Delivery (CI, CD) • docker dockerfile • • Duquan

Rancher & gitlab-runner - is there a way to get the gitlab-runner to tell Rancher to start the CI test environment instead?
Continuous Integration and Delivery (CI, CD) • docker gitlab rancher • • Alberto

Why do some components vanish from the catalog list if one component has been installed in Rancher?
Continuous Integration and Delivery (CI, CD) • rancher • • Pearlaqua

Can the status be running after applying the yaml file?
Continuous Integration and Delivery (CI, CD) • kubernetes • • kalyn

Error: Error creating openstack_compute_floatingip_associate_v2
Continuous Integration and Delivery (CI, CD) • terraform openstack • • jeanid