7.7. Troubleshooting the K3s Configuration Checker

After installing K3s 2, you may optionally run the K3s configuration checker k3s check-config 3 (see Checking the K3s Configuration). This configuration checker runs through a more extensive series of tests, covering "required", "generally necessary", and "optional" system aspects needed by K3s.

Some failures, especially in "optional" aspects, may not actually prevent the cluster from working normally, in the limited ways the LOCKSS system uses Kubernetes. Some of the error messages you might encounter are documented below, but you may need to refer to the official K3s documentation or use a search engine to look up a specific error message.

7.7.1. iptables should be older than v1.8.0, newer than v1.8.3, or in legacy mode

In some instances, you may encounter an error message similar to the following:

/usr/sbin iptables v1.8.2 (nf_tables): should be older than v1.8.0, newer than v1.8.3, or in legacy mode (fail)

In previous versions of K3s, this error message was also sometimes phrased as should be older than v1.8.0 or in legacy mode.

The install-lockss script should detect this situation and offer to switch iptables to legacy mode via Alternatives (see Troubleshooting iptables). If the error above occurs:

7.7.2. User namespaces disabled

In some RHEL 7 and CentOS 7 systems, you may receive the following error message:

RHEL7/CentOS7: User namespaces disabled; add 'user_namespace.enable=1' to boot command line (fail)

To resolve this issue, see Enabling User Namespaces in RHEL 7 and CentOS 7.

7.7.3. apparmor enabled but apparmor_parser missing

In some systems where Apparmor is enabled, you may receive the following error:

apparmor: enabled, but apparmor_parser missing (fail)

To resolve this issue, see Installing apparmor_parser.

7.7.4. cgroup hierarchy nonexistent

In some Arch Linux, Debian and Fedora systems, you may see the following error message:

cgroup hierarchy: nonexistent?? (fail)

K3s supports cgroup2 but k3s check-config version 1.21.5+k3s1 (used in LOCKSS 2.0-alpha5) does not process this condition correctly. This warning can be ignored.

7.7.6. swap should be disabled

This warning can be ignored:

swap: should be disabled


This warning can be ignored:




See Running the LOCKSS Installer.


See Installing K3s.


See Checking the K3s Configuration.








See Running Commands as root.