Run K3s cli command from a pod?

[TheOnlyWei]

Is it possible to run k3s cli commands from a pod? For example, if I want to deploy a pod to run a service.key rotation periodically using the k3s cli command using:

k3s certificate rotate-ca --path=/opt/k3s/server

The best way I found to do this currently is to mount the entire server node file system into a pod, use the server node hostNetwork, hostPID, and a privileged serviceAccountName to chroot the mounted server node file system. Then I can run the k3s command.

However, taking a look at the k3s CLI code, it seems to make HTTP requests, at least for the k3s certificate rotate-ca command:

k3s/pkg/cli/cert/cert.go

Line 269 in 876d54c

url := fmt.Sprintf("/v1-%s/cert/cacerts?force=%t", version.Program, sync.Force)

Is there a way to make such an HTTP request from a pod in the server node's cluster, or even just run the k3s command itself, or is this not a supported use case? Although, even granted that it is possible, I would still need to run some related bash commands remotely for the full rotation and so I would likely need to use the chroot command regardless. But it would be nice to know if the HTTP request method is somehow possible or if there is a way to run k3s command from a pod.

[brandond]

You could play with using the rancher/k3s image? You'd still probably need to mount some things from the host filesystem though.

You could probably look at what the k3s-upgrade image and k3s upgrade system-upgrade-controller plans are doing, as a source of inspiration.