Adding Additional IP Cluster TLS/SSL Certificate to a K3s Kubernetes Cluster
In this article, we will discuss how to add an additional IP cluster TLS/SSL certificate to a K3s Kubernetes cluster with three nodes, where each node has a specific role: control-plane, etcd, and master. We assume that you have successfully set up the cluster, and everything is working as expected. Now, you want to test or play around with installing additional components that require a different IP cluster TLS/SSL certificate.
Prerequisites
- A running K3s Kubernetes cluster with three nodes and the following roles: control-plane, etcd, and master.
- Basic knowledge of Kubernetes and K3s command-line tools.
- Sudo access to all nodes in the cluster.
Understanding the K3s Cluster TLS/SSL Certificates
K3s, like Kubernetes, uses TLS/SSL certificates to secure communication between nodes in the cluster. By default, K3s generates a self-signed certificate for the cluster's IP address during installation. This certificate is used to secure the communication between the nodes in the cluster.
However, there might be situations where you need to add additional IP cluster TLS/SSL certificates. For example, when installing additional components that require a different IP cluster TLS/SSL certificate or when migrating the cluster to a new network with a different IP address range.
Adding an Additional IP Cluster TLS/SSL Certificate
To add an additional IP cluster TLS/SSL certificate to the K3s Kubernetes cluster, you need to perform the following steps:
- Generate a new TLS/SSL certificate for the desired IP address.
- Copy the new certificate and key to all nodes in the cluster.
- Update the K3s configuration on all nodes to use the new certificate and key.
Step 1: Generate a New TLS/SSL Certificate
You can use the following command to generate a new TLS/SSL certificate for the desired IP address:
openssl req -x509 -sha256 -newkey rsa:4096 -nodes -days 365 -keyout tls.key -out tls.crt -subj "/CN=" -addext "subjectAltName=IP:"
Replace `
Step 2: Copy the New Certificate and Key to All Nodes
Use `scp` or a similar tool to copy the new certificate and key to all nodes in the cluster.
scp tls.crt tls.key user@node:/path/to/k3s/server/tls/
Replace `user@node` with the username and IP address of the node, and `/path/to/k3s/server/tls/` with the path to the K3s server's TLS directory.
Step 3: Update the K3s Configuration
To update the K3s configuration on all nodes to use the new certificate and key, you need to modify the K3s configuration file.
First, stop the K3s service on all nodes:
sudo systemctl stop k3s
Then, modify the K3s configuration file `/etc/systemd/system/k3s.service` to include the following options:
Environment="K3S\_TOKEN=" \
Environment="K3S\_URL=https://:6443" \
Environment="K3S\_CLUSTER\_SECRET=" \
Environment="K3S\_TLS\_SNI=" \
Environment="K3S\_TLS\_CLIENT\_CERT=/path/to/tls.crt" \
Environment="K3S\_TLS\_CLIENT\_KEY=/path/to/tls.key" \
ExecStart=/usr/local/bin/k3s server \
Replace `
Finally, start the K3s service on all nodes:
sudo systemctl start k3s
In this article, we discussed how to add an additional IP cluster TLS/SSL certificate to a K3s Kubernetes cluster with three nodes. We covered the following key concepts:
- Understanding the K3s cluster TLS/SSL certificates.
- Adding an additional IP cluster TLS/SSL certificate.
- Generating a new TLS/SSL certificate.
- Copying the new certificate and key to all nodes.
- Updating the K3s configuration on all nodes.