kubelet apiserver ha

[ibrother]

hi all

i noticed that rke2 kubelet's kubeconfig is /var/lib/rancher/rke2/agent/kubelet.kubeconfig,here is the content

apiVersion: v1
clusters:
- cluster:
    server: https://127.0.0.1:6443
    certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt
  name: local
contexts:
- context:
    cluster: local
    namespace: default
    user: user
  name: Default
current-context: Default
kind: Config
preferences: {}
users:
- name: user
  user:
    client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt
    client-key: /vat/lib/rancher/rke2/agent/client-kubelet.key

kubelet uses https://127.0.0.1:6443 to connect to the apiserver, i already setup a ha vip for apiserver, what should i do? just edit this file to use ha vip instead of 127.0.0.1 or any other config to adjust kubelet's kubeconfig?

[ibrother]

node ha no problems now, thanks, i just remembered that

Agents register through the fixed registration address. However, when RKE2 launches the kubelet and it must connect to the Kubernetes api-server, it does so through the rke2 agent process, which acts as a client-side load balancer.

but how about server

[brandond]

Servers need to talk to the "fixed registration endpoint" - a load-balancer or DNS alias backed by existing servers in the cluster.

[ibrother]

thanks for your reply, just edit server's /var/lib/rancher/rke2/agent/kubelet.kubeconfig ?

[brandond]

No, you should not do anything. The server's kubelet points at the local apiserver; the kubelet and apiserver run together in k3s so there's no reason to point them at any other host. Agent kubelets point at the local load-balancer that sends connections to all servers and don't need external load-balancing.

As per the docs, all you need is a stable registration endpoint when adding nodes.

[ibrother]

okay, no problems now, thank u very much!