k3s on Ubuntu: Install, kubectl Access, and Unauthorized Errors

How to install k3s on Ubuntu, connect with kubectl, and fix the 'You must be logged in to the server (Unauthorized)' error caused by kubeconfig or expired certs.

24 Sept 2024 · 2 min read

devops #k3s #kubernetes #linux #devops

Audio summary

k3s is a lightweight, fully compliant Kubernetes distribution. It was designed for unattended, resource-constrained environments, edge and IoT, but the same properties make it a good fit for a home lab or a small single-node cluster: one binary, one command to install, far less to manage than a full kubeadm setup. Here is my setup on Ubuntu, plus the auth error that cost me the most time.

Installing k3s on Ubuntu

Minimum requirements: Ubuntu 18.04 or later, 2 GB RAM, 2 CPUs, 20 GB disk, internet connectivity.

Update system packages:

sudo apt-get update
sudo apt-get upgrade -y

Install k3s:

curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION="v1.23.3+k3s1" sh -

Verify the installation:
```
sudo systemctl status k3s
```
Enable the service on boot:
```
sudo systemctl enable k3s
```

Running k3s

k3s runs as a systemd service, so the usual commands apply:

Start:
```
sudo systemctl start k3s
```
Stop:
```
sudo systemctl stop k3s
```
Restart:
```
sudo systemctl restart k3s
```

Connecting with kubectl

k3s writes its kubeconfig to /etc/rancher/k3s/k3s.yaml. Point kubectl at it:

Set the KUBECONFIG environment variable:

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

Check cluster status:
```
kubectl get nodes
```

Troubleshooting: “You must be logged in to the server (Unauthorized)”

If kubectl get pods -A returns this error, kubectl is talking to the cluster but presenting credentials the API server rejects. Three things to check, in order:

Copy k3s.yaml to the client host. The kubeconfig on the server is the source of truth. Copy it to the machine you are running kubectl from:
```
scp root@k3s-host:/etc/rancher/k3s/k3s.yaml ~/.kube/config
```
Remember to change the server: address in the copied file from 127.0.0.1 to the k3s host’s address.
Set KUBECONFIG correctly.
```
export KUBECONFIG=~/.kube/config
```
Check certificate expiry. This was my actual problem. k3s client certificates expire after a year, and a stale kubeconfig fails with exactly this Unauthorized error:
```
openssl s_client -connect localhost:6443 -showcerts < /dev/null 2>&1 | openssl x509 -noout -enddate
```
If the certificate has expired, restart k3s to rotate it, then copy the regenerated k3s.yaml to your client again.

The lesson from the troubleshooting section is the one worth keeping: an Unauthorized error from a k3s cluster is almost always a kubeconfig problem, either the wrong file or an expired certificate inside it, not anything wrong with the cluster itself.