sveltos is ok join cluster but after a few fimes the connnect to cluster fialed,using kamaji control plane because of this？

[13567436138]

root@ubuntu:~# kubectl get secret -n sveltos-system sveltos-member-01-sveltos-kubeconfig -o jsonpath="{.data.kubeconfig}"|base64 -d > sveltos-member-01-kubeconfig
root@ubuntu:~# kubectl get pod --kubeconfig sveltos-member-01-kubeconfig 
error: You must be logged in to the server (Unauthorized)

[gianlucam76]

Hi @13567436138 I am not sure I get the issue. Sveltos and Kamaji works well together. Sveltos is actually part of Clastix (company behind Kamaji) premium solution.

Here I get the Kubeconfig expired. When you register a cluster with Sveltos you are likely passing a Kubeconfig based on a token with expiration. When token expires, kubeconfig is not good anymore.
Sveltos has the ability to automatically renew it for you. Documentation is available. You need to set in the SveltosCluster instance manually.

[13567436138]

it is not wright just a few hours,it become can not access,I think the token is not renewed current

root@ubuntu:/mnt/某宝商城# kubectl get pod --kubeconfig sveltos-member-01-kubeconfig 
error: You must be logged in to the server (Unauthorized)

[gianlucam76]

Sveltos has the ability to automatically renew it for you. Documentation is available. You need to set in the SveltosCluster instance manually.

At this point you need to register cluster again with a valid kubeconfig.

[13567436138]

tokentimeout 0s means net timeout?

[gianlucam76]

Assuming on the managed cluster the serviceAccount exits (pick the one you want to use otherwise)

tokenRequestRenewalOption: renewTokenRequestInterval: 1h0m0s saName: projectsveltos saNamespace: projectsveltos tokenDuration: 12h0m0s

[13567436138]

kamaji and sveltos not mature enough,kamaji control plane some times restarted

[13567436138]

recently deploy by sveltos app disappeared

[13567436138]

spec:
  consecutiveFailureThreshold: 3
  kubeconfigKeyName: kubeconfig
  pullMode: false
  tokenRequestRenewalOption:
    renewTokenRequestInterval: 1h0m0s
    tokenDuration: 172800s
status:
  connectionFailures: 0
  connectionStatus: Healthy

is sa not set ok?

[13567436138]

Events:
  Type     Reason              Age                  From                     Message
  ----     ------              ----                 ----                     -------
  Normal   Scheduled           100s                 default-scheduler        Successfully assigned consul/consul-consul-server-0 to sveltos-member-04-b
  Warning  FailedAttachVolume  61s (x25 over 100s)  attachdetach-controller  AttachVolume.Attach failed for volume "pvc-e96b429d-9393-47ab-842f-a81102aed33b" : volume attachment is being deleted
root@ubuntu:~# kubectl get volumeattachments -n consul --kubeoconfig ~/.kube/sveltos-member-04
error: unknown flag: --kubeoconfig
See 'kubectl get --help' for usage.
root@ubuntu:~# kubectl get volumeattachments -n consul --kubeconfig ~/.kube/sveltos-member-04
NAME                                                                   ATTACHER             PV                                         NODE                  ATTACHED   AGE
csi-4349e598d4c93f1299cd0addb1ac41763d003ed7ed60962f9fbafd582b98afbc   driver.longhorn.io   pvc-be540b17-93de-4f75-830c-60b817efecfe   sveltos-member-04-d   false      16m
csi-5c704a3bf037e612cfb9528b8c0b0a2b27221f61e79928f8b11c4aa7e46c45b9   driver.longhorn.io   pvc-e5c72514-a6fd-4e70-81ce-418a81e8a7d8   sveltos-member-04-c   true       19m
csi-74568f2ddc7b1c3463761e5e8eb84dba1598df19b5d65d0e9bb9c4b02169a47d   driver.longhorn.io   pvc-263c10ef-6351-4f11-a7f7-9f9e269d9331   sveltos-member-04-c   false      16m
csi-7512919afa3d2ab6150939499732eecef3dbf025814a789e2063f191430c40ee   driver.longhorn.io   pvc-263c10ef-6351-4f11-a7f7-9f9e269d9331   sveltos-member-04-d   false      6m54s
csi-9950a4b2ece64c4f11a4c5c4d083d64393ce805ef0633a579b5c72d00c744177   driver.longhorn.io   pvc-720c3f53-1aff-4fdb-9edf-242a0bd1de43   sveltos-member-04-b   true       19m
csi-9c9d1896f0ea7e1b6e202bb89c624147d75842827f022ae5d6d6fc97e33cd318   driver.longhorn.io   pvc-e96b429d-9393-47ab-842f-a81102aed33b   sveltos-member-04-d   false      5m43s
csi-c09b44f0487ad63c2c51b29115c0a2a59eb3c848265e7558cb57635fe185e548   driver.longhorn.io   pvc-be540b17-93de-4f75-830c-60b817efecfe   sveltos-member-04-c   false      6m54s
csi-dedf84a10b4047778de265e182d79d6b24930aedd6d114b3229e6d58dedc37be   driver.longhorn.io   pvc-e96b429d-9393-47ab-842f-a81102aed33b   sveltos-member-04-b   false      16m
csi-ee713735ef07419ad0f8a12e6ee737cb2647c19d9849aeb576859a790f9c3812   driver.longhorn.io   pvc-d0420b18-a3e3-4437-b632-cbc71196271b   sveltos-member-04-d   true       19m
root@ubuntu:~# kubectl get volumeattachments  --kubeconfig ~/.kube/sveltos-member-04
NAME                                                                   ATTACHER             PV                                         NODE                  ATTACHED   AGE
csi-4349e598d4c93f1299cd0addb1ac41763d003ed7ed60962f9fbafd582b98afbc   driver.longhorn.io   pvc-be540b17-93de-4f75-830c-60b817efecfe   sveltos-member-04-d   false      16m
csi-5c704a3bf037e612cfb9528b8c0b0a2b27221f61e79928f8b11c4aa7e46c45b9   driver.longhorn.io   pvc-e5c72514-a6fd-4e70-81ce-418a81e8a7d8   sveltos-member-04-c   true       19m
csi-74568f2ddc7b1c3463761e5e8eb84dba1598df19b5d65d0e9bb9c4b02169a47d   driver.longhorn.io   pvc-263c10ef-6351-4f11-a7f7-9f9e269d9331   sveltos-member-04-c   false      16m
csi-7512919afa3d2ab6150939499732eecef3dbf025814a789e2063f191430c40ee   driver.longhorn.io   pvc-263c10ef-6351-4f11-a7f7-9f9e269d9331   sveltos-member-04-d   false      7m15s
csi-9950a4b2ece64c4f11a4c5c4d083d64393ce805ef0633a579b5c72d00c744177   driver.longhorn.io   pvc-720c3f53-1aff-4fdb-9edf-242a0bd1de43   sveltos-member-04-b   true       19m
csi-9c9d1896f0ea7e1b6e202bb89c624147d75842827f022ae5d6d6fc97e33cd318   driver.longhorn.io   pvc-e96b429d-9393-47ab-842f-a81102aed33b   sveltos-member-04-d   false      6m4s
csi-c09b44f0487ad63c2c51b29115c0a2a59eb3c848265e7558cb57635fe185e548   driver.longhorn.io   pvc-be540b17-93de-4f75-830c-60b817efecfe   sveltos-member-04-c   false      7m15s
csi-dedf84a10b4047778de265e182d79d6b24930aedd6d114b3229e6d58dedc37be   driver.longhorn.io   pvc-e96b429d-9393-47ab-842f-a81102aed33b   sveltos-member-04-b   false      16m
csi-ee713735ef07419ad0f8a12e6ee737cb2647c19d9849aeb576859a790f9c3812   driver.longhorn.io   pvc-d0420b18-a3e3-4437-b632-cbc71196271b   sveltos-member-04-d   true       19m
root@ubuntu:~# kubectl get pvc -n consul  --kubeconfig ~/.kube/sveltos-member-04
NAME                                 STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
data-consul-consul-consul-server-0   Bound    pvc-e96b429d-9393-47ab-842f-a81102aed33b   10Gi       RWO            longhorn       <unset>                 4h52m
data-consul-consul-consul-server-1   Bound    pvc-263c10ef-6351-4f11-a7f7-9f9e269d9331   10Gi       RWO            longhorn       <unset>                 4h52m
data-consul-consul-consul-server-2   Bound    pvc-be540b17-93de-4f75-830c-60b817efecfe   10Gi       RWO            longhorn       <unset>                 4h52m

[gianlucam76]

Im not sure im following. When you register a cluster with sveltos you pass a kubeconfig. As long as that kubeconfig is valid sveltos can access the managed cluster.

If the kubeconfig you passed sveltos has an expiration time you either renew it before ot expires or you set sveltos to automatically renew it for you.

Likely I am missing something on what your issue is

[gianlucam76]

Also I suggest setting sa namespace/name on the token renewal section. By default this is what sveltos does to figure out which sa to use for token renewal

`
for i := range config.Contexts {
cc := &config.Contexts[i]
saNamespace := cc.Context.Namespace
saName := cc.Context.AuthInfo

		if sveltosCluster.Spec.TokenRequestRenewalOption.SANamespace != "" && sveltosCluster.Spec.TokenRequestRenewalOption.SAName != "" {
			saNamespace = sveltosCluster.Spec.TokenRequestRenewalOption.SANamespace
			saName = sveltosCluster.Spec.TokenRequestRenewalOption.SAName
		}

		tokenRequest, err := r.getServiceAccountTokenRequest(ctx, remoteConfig, saNamespace, saName, saExpirationInSecond, logger)
		if err != nil {
			logger.V(logs.LogInfo).Info(fmt.Sprintf("failed to get tokenRequest %v", err))
			continue
		}

`