Steps to verify certificate state for custom clusters in v2.2
Run script below to output certificate checksums for certificates present on the node.
#!/bin/sh
| #!/bin/zsh | |
| # | |
| # Purpose: run specified command with specified arguments and cache result. If cache is fresh enough, don't run command again but return cached output. | |
| # Also cache exit status and stderr. | |
| # Copyright (c) 2019-2023 András Korn; License: GPLv3 | |
| # Use silly long variable names to avoid clashing with whatever the invoked program might use | |
| RUNCACHED_MAX_AGE=${RUNCACHED_MAX_AGE:-300} | |
| RUNCACHED_IGNORE_ENV=${RUNCACHED_IGNORE_ENV:-0} | |
| RUNCACHED_IGNORE_PWD=${RUNCACHED_IGNORE_PWD:-0} |
| #0 ns-0.awsdns-00.com. 205.251.192.0 | |
| #1 ns-1.awsdns-00.com. 205.251.192.1 | |
| #2 ns-2.awsdns-00.com. 205.251.192.2 | |
| #3 ns-3.awsdns-00.com. 205.251.192.3 | |
| #4 ns-4.awsdns-00.com. 205.251.192.4 | |
| #5 ns-5.awsdns-00.com. 205.251.192.5 | |
| #6 ns-6.awsdns-00.com. 205.251.192.6 | |
| #7 ns-7.awsdns-00.com. 205.251.192.7 | |
| #8 ns-8.awsdns-01.com. 205.251.192.8 | |
| #9 ns-9.awsdns-01.com. 205.251.192.9 |
| # More information can be found at https://docs.gitlab.com/ee/user/infrastructure/#gitlab-managed-terraform-state | |
| terraform { | |
| backend "http" { | |
| } | |
| } |
| # My ISP-provided fiber optical modem broadcasts a line of a poem every ten seconds. Here's the tcpdump of the complete poem. | |
| # The optical modem is made by Shanghai Nokia-Bell Co.,Ltd and its model number is G-140W-UD. It's provided by my ISP, China Unicom in Shenzhen. | |
| $ tcpdump -i vlan10 ether proto 0x8300 | |
| 15:59:00.720301 00:00:00:00:00:12 (oui Ethernet) > Broadcast, ethertype Unknown (0x8300), length 72: | |
| 0x0000: 0000 0000 e4ea 8386 d93c 5468 6520 6461 .........<The.da | |
| 0x0010: 7920 4920 6c6f 7374 206d 7920 7665 7279 y.I.lost.my.very | |
| 0x0020: 2066 6972 7374 2074 6f6f 7468 2c00 0000 .first.tooth,... | |
| 0x0030: 0000 0000 0000 0000 0000 .......... | |
| 15:59:10.740778 00:00:00:00:00:12 (oui Ethernet) > Broadcast, ethertype Unknown (0x8300), length 72: |
By default, K3S will run with flannel as the CNI and use custom directories to store CNI plugin binaries and config files(You can inspect the kubelet args K3S uses via journalctl -u k3s|grep cni-conf-dir).
So you need to configure that properly When deploying Multus CNI.
For example given the official Multus manifests in https://github.com/intel/multus-cni/blob/36f2fd64e0965e639a0f1d17ab754f0130951aba/images/multus-daemonset.yml, the following changes are needed:
volumes:
- name: cni