{"record":{"id":"7244f1f506ea3180","repo":"k3s-io/k3s","slug":"invalid-flag-use-cannot-use-disable-apiserver-w","errorCode":null,"errorMessage":"invalid flag use; cannot use --disable-apiserver with --datastore-endpoint","messagePattern":"invalid flag use; cannot use --disable-apiserver with --datastore-endpoint","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cli/server/server.go","lineNumber":262,"sourceCode":"\n\tif cfg.ClusterResetRestorePath != \"\" && !cfg.ClusterReset {\n\t\treturn errors.New(\"invalid flag use; --cluster-reset required with --cluster-reset-restore-path\")\n\t}\n\n\tserverConfig.ControlConfig.ClusterReset = cfg.ClusterReset\n\tserverConfig.ControlConfig.ClusterResetRestorePath = cfg.ClusterResetRestorePath\n\tserverConfig.ControlConfig.SystemDefaultRegistry = cfg.SystemDefaultRegistry\n\n\tif serverConfig.ControlConfig.SupervisorPort == 0 {\n\t\tserverConfig.ControlConfig.SupervisorPort = serverConfig.ControlConfig.HTTPSPort\n\t}\n\n\tif serverConfig.ControlConfig.DisableETCD && serverConfig.ControlConfig.JoinURL == \"\" {\n\t\treturn errors.New(\"invalid flag use; --server is required with --disable-etcd\")\n\t}\n\n\tif serverConfig.ControlConfig.Datastore.Endpoint != \"\" && serverConfig.ControlConfig.DisableAPIServer {\n\t\treturn errors.New(\"invalid flag use; cannot use --disable-apiserver with --datastore-endpoint\")\n\t}\n\n\tif serverConfig.ControlConfig.Datastore.Endpoint != \"\" && serverConfig.ControlConfig.DisableETCD {\n\t\treturn errors.New(\"invalid flag use; cannot use --disable-etcd with --datastore-endpoint\")\n\t}\n\n\tif serverConfig.ControlConfig.DisableAPIServer {\n\t\t// Servers without a local apiserver need to connect to the apiserver via the proxy load-balancer.\n\t\tserverConfig.ControlConfig.APIServerPort = cmds.AgentConfig.LBServerPort\n\t\t// If the supervisor and externally-facing apiserver are not on the same port, the proxy will\n\t\t// have a separate load-balancer for the apiserver that we need to use instead.\n\t\tif serverConfig.ControlConfig.SupervisorPort != serverConfig.ControlConfig.HTTPSPort {\n\t\t\tserverConfig.ControlConfig.APIServerPort = cmds.AgentConfig.LBServerPort - 1\n\t\t}\n\t}\n\n\tif cmds.AgentConfig.FlannelIface != \"\" && len(cmds.AgentConfig.NodeIP.Value()) == 0 {\n\t\tip, err := util.GetIPFromInterface(cmds.AgentConfig.FlannelIface)","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/cli/server/server.go#L244-L280","documentation":"--disable-apiserver designates a server that skips the local apiserver (e.g. an etcd-only member) and reaches the API through another server's load-balancer. --datastore-endpoint configures an external datastore for the embedded apiserver, so the two flags describe incompatible topologies and k3s rejects the combination.","triggerScenarios":"`k3s server --disable-apiserver --datastore-endpoint=mysql://user:pass@host:3306/k3s` (any external datastore URI: MySQL, Postgres, etcd).","commonSituations":"Migrating a cluster from embedded etcd to an external datastore and leaving stale HA flags behind; environment K3S_DATASTORE_ENDPOINT set on a node configured for split control-plane roles.","solutions":["If using an external datastore, remove --disable-apiserver and let this node run an apiserver against the datastore","If running etcd-only members with --disable-apiserver, remove --datastore-endpoint and join with --server instead","Audit config.yaml, env files and systemd drop-ins for the leftover flag before restart"],"exampleFix":"# before\nk3s server --disable-apiserver --datastore-endpoint=mysql://u:p@db:3306/k3s\n\n# after\nk3s server --datastore-endpoint=mysql://u:p@db:3306/k3s","handlingStrategy":"validation","validationCode":"# reject mutually exclusive topology flags\nif printf '%s' \"$K3S_DATASTORE_ENDPOINT\" | grep -q . && printf '%s' \"$@\" | grep -q -- '--disable-apiserver'; then\n  echo 'cannot use --disable-apiserver with --datastore-endpoint'; exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Encode cluster topology as a single variable (embedded vs external datastore) and derive flags from it","Clean env vars (K3S_DATASTORE_*) when switching topologies","Config-management (Ansible/Helm) should validate flag combinations per role before rollout"],"tags":["datastore","apiserver","configuration","ha"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}