k0s workers are not using private IP address to access the k8s API server

[shinebayar-g]

Before creating an issue, make sure you've checked the following:

• You are running the latest released version of k0s
• Make sure you've searched for existing issues, both open and closed
• Make sure you've searched for PRs too, a fix might've been merged already
• You're looking at docs for the released version, "main" branch docs are usually ahead of released versions.

Platform

Ubuntu 24.04.3 LTS

Version

v1.33.8+k0s.1

Sysinfo

`k0s sysinfo`

➡️ Please replace this text with the output of `k0s sysinfo`. ⬅️

What happened?

k0sctl is using public IP address to connect to the control plane.

apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
metadata:
  name: k0s-cluster
  user: admin
spec:
  k0s:
    version: v1.33.8+k0s.1
    config:
      apiVersion: k0s.k0sproject.io/v1beta1
      kind: ClusterConfig
      metadata:
        name: my-k0s-cluster
        namespace: kube-system
  hosts:
    - role: controller+worker
      ssh:
        address: CP_1_PUBLIC_IPV4
        user: root
        port: 22
      privateInterface: enp7s0
    - role: worker
      ssh:
        address: WORKER_1_PUBLIC_IPV4
        user: root
        port: 22
      privateInterface: enp7s0
    - role: worker
      ssh:
        address: WORKER_2_PUBLIC_IPV4
        user: root
        port: 22
      privateInterface: enp7s0
    - role: worker
      ssh:
        address: WORKER_3_PUBLIC_IPV4
        user: root
        port: 22
      privateInterface: enp7s0

Steps to reproduce

1. k0sctl apply --config k0sctl.yaml
2. Fail

Expected behavior

Servers have public and private IP addresses. I assume the intent of defining the privateInterface and/or privateAddress is to use the private network for Kubernetes communication.

Actual behavior

But k0sctl is still trying to use the public network and failing because firewall is configured for the private interfaces.

Screenshots and logs

INFO ==> Running phase: Install workers
INFO [ssh] CP_1_PUBLIC_IPV4:22: generating a join token for worker 1
INFO [ssh] CP_1_PUBLIC_IPV4:22: generating a join token for worker 2
INFO [ssh] CP_1_PUBLIC_IPV4:22: generating a join token for worker 3
INFO [ssh] WORKER_1_PUBLIC_IPV4:22: validating api connection to https://CP_1_PUBLIC_IPV4:6443 using join token
INFO [ssh] WORKER_3_PUBLIC_IPV4:22: validating api connection to https://CP_1_PUBLIC_IPV4:6443 using join token
INFO [ssh] WORKER_2_PUBLIC_IPV4:22: validating api connection to https://CP_1_PUBLIC_IPV4:6443 using join token
INFO * Running clean-up for phase: Acquire exclusive host lock
INFO * Running clean-up for phase: Install workers
INFO [ssh] WORKER_1_PUBLIC_IPV4:22: cleaning up
INFO [ssh] WORKER_2_PUBLIC_IPV4:22: cleaning up
INFO [ssh] WORKER_3_PUBLIC_IPV4:22: cleaning up
INFO ==> Apply failed
FATA apply failed - log file saved to /Users/user/Library/Caches/k0sctl/k0sctl.log: failed on 3 hosts:
 - [ssh] WORKER_3_PUBLIC_IPV4:22: connectivity check failed: context deadline exceeded
failed to connect to kubernetes api using the join token - check networking: command failed: client exec: ssh session wait: Process exited with status 1
 - [ssh] WORKER_1_PUBLIC_IPV4:22: connectivity check failed: context deadline exceeded
failed to connect to kubernetes api using the join token - check networking: command failed: client exec: ssh session wait: Process exited with status 1
 - [ssh] WORKER_2_PUBLIC_IPV4:22: connectivity check failed: context deadline exceeded
failed to connect to kubernetes api using the join token - check networking: command failed: client exec: ssh session wait: Process exited with status 1

Additional context

No response

[kke]

Transfered from k0s as this has been planned to be done as something like this in k0sctl:

spec:
  hosts:
    - role: controller
      k0s:
        config:
          spec:
            api:
              address: 10.0.0.1
    k0s:
      config:
        spec:
          api:
            address: k8s.example.com

and the host specific parts would be merged over the global k0s config for each host.

[kke]

#1026 is related

[shinebayar-g]

Makes sense. I assumed spec.hosts[*].privateInterface would be used for k8s communication purposes and that was wrong.

It's unclear what's the purpose of spec.hosts[*].privateInterface, could you clarify?

Override private network interface selected by host fact gathering. Useful in case fact gathering picks the wrong private network interface.

I have no idea what this explanation means.

Also, since spec.k0s.config.spec.api.address it's a single IP address, is it expecting load balancer IP?

apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
metadata:
  name: k0s-cluster
  user: admin
spec:
  k0s:
    version: v1.33.8+k0s.1
    config:
      apiVersion: k0s.k0sproject.io/v1beta1
      kind: ClusterConfig
      metadata:
        name: my-k0s-cluster
        namespace: kube-system
      spec:
        api:
          address: 192.168.5.15 # Is this supposed to be LB address?