How to access the /etc/ folder in a node in order to create inside .key . crt pair of files ?

[raphael10-collab]

Hi!
I get this error message:

/etc/nats-certs/nats/tls.crt: no such file or directory"

I need to create a pair key-crt of files in the control-plane node .

How to access the /etc/ folder in a node?

[smira]

There is no way to do that, and you should not be doing it. Talos rootfs is immutable/read-only with small exceptions.

[raphael10-collab]

@rothgar

raphy@raohy:~/.talos/oryx$ kubectl get all
NAME                                 READY   STATUS    RESTARTS        AGE
pod/nats-0                           2/2     Running   350 (14m ago)   8d
pod/nats-box-7846c8b77b-4fnvq        1/1     Running   181 (14m ago)   8d
pod/srs-srs-server-74b489b68-jjt96   1/1     Running   20 (14m ago)    23h

NAME                     TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                                                                       AGE
service/kubernetes       ClusterIP      10.96.0.1       <none>          443/TCP                                                                       34d
service/nats             ClusterIP      10.99.254.16    <none>          4222/TCP,7422/TCP                                                             8d
service/nats-headless    ClusterIP      None            <none>          4222/TCP,7422/TCP,8222/TCP                                                    8d
service/nats-ingress     NodePort       10.98.199.116   <none>          30100:30101/TCP                                                               9d
service/srs-srs-server   LoadBalancer   10.105.115.3    10.97.110.241   1935:31768/TCP,8080:31282/TCP,1985:30176/TCP,10080:32064/UDP,8000:31117/UDP   23h  // <----------------------------------

NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/nats-box         1/1     1            1           8d
deployment.apps/srs-srs-server   1/1     1            1           23h

NAME                                       DESIRED   CURRENT   READY   AGE
replicaset.apps/nats-box-7846c8b77b        1         1         1       8d
replicaset.apps/srs-srs-server-74b489b68   1         1         1       23h

NAME                    READY   AGE
statefulset.apps/nats   1/1     8d

The service is srs-srs-server :

service/srs-srs-server   LoadBalancer   10.105.115.3    10.97.110.241   1935:31768/TCP,8080:31282/TCP,1985:30176/TCP,10080:32064/UDP,8000:31117/UDP   23h

Since I don't understand which exact port to use, I tried them all :

raphy@raohy:~/.talos/oryx$ kubectl debug -n kube-system -it --image alpine node/talos-c9n-h4k
Creating debugging pod node-debugger-talos-c9n-h4k-gcqn2 with container debugger on node talos-c9n-h4k.
If you don't see a command prompt, try pressing enter.
/ # apk add curl
OK: 12 MiB in 25 packages
/ # 

/ # curl http://localhost:1935
curl: (7) Failed to connect to localhost port 1935 after 0 ms: Could not connect to server
/ # curl http://localhost:31768
curl: (7) Failed to connect to localhost port 31768 after 0 ms: Could not connect to server
/ # 
/ # curl http://localhost:8080
curl: (7) Failed to connect to localhost port 8080 after 0 ms: Could not connect to server
/ # curl http://localhost:31282
curl: (7) Failed to connect to localhost port 31282 after 0 ms: Could not connect to server
/ # 
/ # curl http://localhost:1985
curl: (7) Failed to connect to localhost port 1985 after 0 ms: Could not connect to server
/ # curl http://localhost:30176
curl: (7) Failed to connect to localhost port 30176 after 0 ms: Could not connect to server
/ # 
/ # curl http://localhost:10080
curl: (7) Failed to connect to localhost port 10080 after 0 ms: Could not connect to server
/ # curl http://localhost:32064
curl: (7) Failed to connect to localhost port 32064 after 0 ms: Could not connect to server
/ # 
/ # curl http://localhost:8000
curl: (7) Failed to connect to localhost port 8000 after 0 ms: Could not connect to server
/ # curl http://localhost:31117
curl: (7) Failed to connect to localhost port 31117 after 0 ms: Could not connect to server

[rothgar]

According to that output the port exposed on the host is 31282. The output shows POD_PORT:NODE_PORT so the output 8080:31282 means the pod is listening on 8080 and the node is listening on 31282.

[raphael10-collab]

curling node does not work

service/srs-srs-server   LoadBalancer   10.105.115.3    10.97.110.241   1935:31768/TCP,8080:31282/TCP,1985:30176/
TCP,10080:32064/UDP,8000:31117/UDP   3d5h

raphy@raohy:~/.talos$ kubectl debug -n kube-system -it --image alpine node/talos-c9n-h4k
Creating debugging pod node-debugger-talos-c9n-h4k-mlmpx with container debugger on node talos-c9n-h4k.

/ # apk add curl

/ # curl http://localhost:31282
curl: (7) Failed to connect to localhost port 31282 after 0 ms: Could not connect to server

[rothgar]

I'm not sure what you actual goal of this is, but the current conversation is very different than the original discussion. If you can open a new discussion with what you're trying to do and a repeatable way we can validate it might be easier to test.

Ideally, you would have a kubernetes workload running in the cluster that has access to the exposed kubernetes service and not trying to run temporary, privledged debug containers on the host. Alternatively, you could run a side car container with the application that will be in the same network namespace as the workload and localhost would work.

[raphael10-collab]

@rothgar actually you are right. Sorry for mixing questions. I will come back with a new discussion. Thank you for your kind help