docs/cilium/

[giscus[bot]]

docs/cilium/

How to install Cilium CNI in the picluster.

https://picluster.ricsanfre.com/docs/cilium/

[pandur2012]

Hello Ricardo,
Thank you very much for this great work. Your project was the basis for my own K3S cluster, it was the source that helped me understand the complex world of Kubernetes a little more clearly. Thank you for that!

Best regards,
Rafael

[ricsanfre]

Hi Rafael,

Thanks for your comment. Glad to hear that this project has been useful in your learning journey.

Regards
Ricardo

[mcmadhatter]

Hello

Thank you for this project, I have being trying to get it running using the quickstart instructions, but cilium is always failing to install for me.
The worker nodes are showing as up

kubectl get nodes
NAME STATUS ROLES AGE VERSION
node2 Ready control-plane,etcd 12m v1.34.1+k3s1
node3 Ready control-plane,etcd 10m v1.34.1+k3s1
node4 Ready control-plane,etcd 9m35s v1.34.1+k3s1
node5 Ready worker 8m34s v1.34.1+k3s1
node6 Ready worker 7m49s v1.34.1+k3s1

but wait for K3S worker nodes to be ready in cilium config never picks this up.

The next line would also fail as the system is in the met state rather than established.
kubectl wait --for condition=established --timeout=60s crd/ciliuml2announcementpolicies.cilium.io crd/ciliuml2announcementpolicies.cilium.io
customresourcedefinition.apiextensions.k8s.io/ciliuml2announcementpolicies.cilium.io condition met
customresourcedefinition.apiextensions.k8s.io/ciliuml2announcementpolicies.cilium.io condition met

Just wondering if there is anything else I could look out for to work out what is going wrong?

[mcmadhatter]

Sorry forgot to mention, by quickstart instructions I mean with the excellent instructions on your quickstart page, when calling the make k3s-bootstrap step.

[ricsanfre]

HI @mcmadhatter

Do you have the logs from make k3s-bootstrap command? Did the previous step (make k3s-install) finish with any error?

Have you tried to execute manually the commands from the ansible-runner docker image directly?

Open a bash session

ansible-runner/ansible-runner.sh /bin/bash

And within the docker ansible-runner session you can execute directly the kubectl commands to check the node status and to check if cilum helm chart has been installed with command helm ls -A

You can also execute the ansible playbook in verbose mode.

ansible-playbook k3s_bootstrap.yml -vvv

Regards
Ricardo

[mcmadhatter]

Hi

Thanks for the pointers, k3s-install went through ok no errors. Looks like the issue is with the docker container created during the make prepare-ansible step, but it is an odd one.

running kubectl get nodes from within the ansible runner gives tls errors, copy the cube config out of the docker filesystem and onto my Mac, and running kubectl from there works fine, same config (md5sum as a quick check there are no differences)

❯ md5sum ~/.kube/config
6cbad49b469542b392f94e5324372cc7 /Users/me/.kube/config
❯ kubectl get nodes
NAME STATUS ROLES AGE VERSION
node2 Ready control-plane,etcd 26h v1.34.2+k3s1
node3 Ready control-plane,etcd 26h v1.34.2+k3s1
node4 Ready control-plane,etcd 26h v1.34.2+k3s1
node5 Ready worker 26h v1.34.2+k3s1
node6 Ready worker 26h v1.34.2+k3s1
❯ ansible-runner/ansible-runner.sh /bin/bash
runner@24ae902760f3:/runner$ md5sum .kube/config
6cbad49b469542b392f94e5324372cc7 .kube/config
runner@24ae902760f3:/runner$ kubectl get nodes
E1201 21:18:45.669181 21808 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get "https://10.0.0.11:6443/api?timeout=32s\": local error: tls: bad record MAC"
E1201 21:18:45.689341 21808 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get "https://10.0.0.11:6443/api?timeout=32s\": local error: tls: bad record MAC"
E1201 21:18:45.706949 21808 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get "https://10.0.0.11:6443/api?timeout=32s\": local error: tls: bad record MAC"
E1201 21:18:45.728602 21808 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get "https://10.0.0.11:6443/api?timeout=32s\": local error: tls: bad record MAC"
E1201 21:18:45.746364 21808 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get "https://10.0.0.11:6443/api?timeout=32s\": local error: tls: bad record MAC"
Unable to connect to the server: local error: tls: bad record MAC

As a workaround currently I'll run the ansible k3s-bootstrap steps manually.