I have been trying to configure service account volume projection using --k3s-args, but when doing so the cluster fails to create. Sometimes the error is ...
ERRO[0005] Failed Cluster Start: Failed to start server k3d-workload-identity-server-0: Node k3d-workload-identity-server-0 failed to get ready: error waiting for log linek3s is up and running...
and at other times a little different.
I have tried passing the args using a config file and the command-line. In both cases the behaviour is the same (cluster creation fails):
I also have a k3s cluster which does respond to a request for the OIDC discovery document:
kubectl get --raw /.well-known/openid-configuration
{"issuer":"https://kubernetes.default.svc.cluster.local","jwks_uri":"https://xxx.xxx.xxx.xx:6443/openid/v1/jwks","response_types_supported":["id_token"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"]}
So this suggests that it is supported in k3s.
Can you advise whether these flags are supported in k3d ?
Refs:
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection https://docs.k3s.io/advanced#starting-the-server-with-the-installation-script
I have been trying to configure service account volume projection using --k3s-args, but when doing so the cluster fails to create. Sometimes the error is ...
ERRO[0005] Failed Cluster Start: Failed to start server k3d-workload-identity-server-0: Node k3d-workload-identity-server-0 failed to get ready: error waiting for log line
k3s is up and running...
and at other times a little different.
I have tried passing the args using a config file and the command-line. In both cases the behaviour is the same (cluster creation fails):
Snippet from k3d-config.yml:
and the command line
k3d cluster create workload-identity --servers 1 --agents 2 ... --k3s-arg --service-account-issuer=https://host.desktop.homelab:6443@server:* --k3s-arg --service-account-jwks-uri=https://host.desktop.homelab:6443/openid/v1/jwks@server:* --k3s-arg --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key@server:* --k3s-arg --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key@server:*
Looking at the advanced configuration for k3s here, the output window shows some of these args being used.
I also have a k3s cluster which does respond to a request for the OIDC discovery document:
So this suggests that it is supported in k3s.
Can you advise whether these flags are supported in k3d ?
Kind Regards
Fraser.