rancher-users #general

crooked-egg-99920

01/12/2023, 6:22 AM

Hi All, on rke2 cluster how can we provide max size for container log? Tried providing container-log-max-size to kubelet arg. It does not honor that where as max-files is honored. Please suggest

polite-agency-93525

01/12/2023, 6:52 AM

Hey everyone 👋! I wanted to share a really cool project that I've been working on for IoT development 🐝 It's called Shifu and it's a Kubernetes-native, production-grade, protocol & vendor agnostic IoT development framework. 🐢 Shifu is a simple and efficient solution for connecting to and managing IoT devices in a Kubernetes environment. I think a lot of you folks here using K8s can find it super useful. It simplifies the process of connecting to IoT devices, allows scalability and high availability, and enables deployment of updates seamlessly. Would love to hear your thoughts and suggestions on how to make it even better! (also yay for any community support on product hunt 🤍) Check it out here: 👀 https://github.com/Edgenesis/shifu

big-jordan-45387

01/12/2023, 9:20 AM

which nci plugin does rancher install when k8s version is based on k3s? the reason I ask is because rke2 asks users to chose one but k3s does not so I believe it has one defined by default? which one is it or how can I find it?

victorious-notebook-35592

01/12/2023, 9:48 AM

Hi all, a quick question as I'm not able to find using search engine (or maybe I'm lacking keywords) Following instructions provided in Launching Kubernetes on Existing Custom Nodes docs, one should use the command copied from rancher manager UI and execute it on linux nodes My question, as I'm not able to identify on docs, from where it's triggered the RKE installation? As I want to collect logs and troubleshoot the embedded RKE installation method, or maybe, in the future force a configuration in the event of getting a stalled RKE change

early-lifeguard-63817

01/12/2023, 1:15 PM

busy-napkin-41956

01/12/2023, 2:11 PM

Has anyone deployed Minio in an RKE2 instance. Our SecurityContext does not permit AllowPrivilegeEscalation, and the operator within Minio calls an init container for the log search that requires PrivilegeEscalation.

abundant-hair-58573

01/12/2023, 3:22 PM

I'm running an RKE cluster in an air-gapped environment using ec2, currently we have cloud provider as none. I want to configure the cluster to use AWS as the cloud provider, when I change that config in cluster management I get stuck in provisioning with the kubelet on the control plane failing. It fails trying to describe ec2 instances with a "certificate signed by unknown authority" error. I checked /etc/ssl in the kubelet pod and our ca.crt is in there

abundant-hair-58573

01/12/2023, 3:39 PM

It doesn't appear to be many options for the "cloud provider" config in RKE1, does anyone know if there's a way to either specify the CA that should be used, or just tell it to run all aws commands in insecure mode? Or do I need to have my CA somewhere else?

few-lion-86098

01/12/2023, 4:07 PM

will the kubernetes cluster work fine if the rancher server that manages it goes down ? i agree that there might be issue with scaling / auto healing of nodes , but the k3s shd work just fine with pod auto scaling enabled ryt ?

happy-tent-70860

01/12/2023, 4:26 PM

Dear all, I have an issue with upgrade rancher from 2.6.8 to 2.7.0. after the rancher upgrade with helm, the fleet-agent didn't got upgraded on the local cluster and some of the downstream clusters (clusters which had not ready bundles). It looks similar to an older issue: https://github.com/rancher/fleet/issues/206 What could I do to force the upgrade of the fleet-agent? Thank you!

happy-king-18397

01/12/2023, 5:57 PM

getting the following error when installing rancher desktop anyone familiar on how to resolve? Error Starting Kubernetes Error: connect EACCES xxx.xx.xx.xx:6443

big-jordan-45387

01/12/2023, 6:50 PM

hi, I am trying to create a new cluster in rancher using rke2 (I am very new to rancher), deployment fails because cattler-cluster-agent can't resolve the rancher server dns. I kept digging into this and I found this error in calico:

Copy code

2023-01-12 18:18:10.939 [INFO][148571] felix/ipsets.go 309: Retrying after an ipsets update failure... family="inet"
2023-01-12 18:18:10.941 [INFO][148571] felix/ipsets.go 779: Doing full IP set rewrite family="inet" numMembersInPendingReplace=1 setID="all-ipam-pools"
2023-01-12 18:18:10.941 [INFO][148571] felix/ipsets.go 779: Doing full IP set rewrite family="inet" numMembersInPendingReplace=1 setID="masq-ipam-pools"
2023-01-12 18:18:10.941 [INFO][148571] felix/ipsets.go 779: Doing full IP set rewrite family="inet" numMembersInPendingReplace=6 setID="this-host"
2023-01-12 18:18:10.941 [INFO][148571] felix/ipsets.go 779: Doing full IP set rewrite family="inet" numMembersInPendingReplace=0 setID="all-vxlan-net"
2023-01-12 18:18:10.943 [WARNING][148571] felix/ipsets.go 713: Failed to complete ipset restore, IP sets may be out-of-sync. closeErr=<nil> commitErr=<nil> family="inet" flushErr=<nil> input="create cali40all-ipam-pools hash:net family inet maxelem 1048576\ncreate cali4t32 hash:net family inet maxelem 1048576\nadd cali4t32 10.42.0.0/16\nswap cali40all-ipam-pools cali4t32\ndestroy cali4t32\ncreate cali40masq-ipam-pools hash:net family inet maxelem 1048576\ncreate cali4t33 hash:net family inet maxelem 1048576\nadd cali4t33 10.42.0.0/16\nswap cali40masq-ipam-pools cali4t33\ndestroy cali4t33\ncreate cali40this-host hash:ip family inet maxelem 1048576\ncreate cali4t34 hash:ip family inet maxelem 1048576\nadd cali4t34 127.0.0.0\nadd cali4t34 127.0.0.1\nadd cali4t34 10.100.32.62\nadd cali4t34 148.187.113.235\nadd cali4t34 172.17.0.1\nadd cali4t34 10.42.224.64\nswap cali40this-host cali4t34\ndestroy cali4t34\ncreate cali40all-vxlan-net hash:net family inet maxelem 1048576\ncreate cali4t35 hash:net family inet maxelem 1048576\nswap cali40all-vxlan-net cali4t35\ndestroy cali4t35\nCOMMIT\n" processErr=exit status 1 stderr="ipset v7.11: Error in line 1: Kernel error received: set type not supported\n" stdout="" writeErr=<nil>
2023-01-12 18:18:10.943 [WARNING][148571] felix/ipsets.go 340: Failed to update IP sets. Marking dataplane for resync. error=exit status 1 family="inet"

My hosts are suse enterprise 15.3 and rancher version I am using is v2.7.0 and v1.24.8+rke2r1

creamy-accountant-88363

01/12/2023, 7:41 PM

Hi, Is there a feature flag in Rancher server to disabled RKE2, and not to create CAPI CRDs? I want to bring my own CAPI providers, and am finding that the rancher implementation is getting in the way of this: • Rancher installs its own versions of CAPI CRDs that may not necessarily be desired CRD versions • Rancher has its own CAPI webhooks that conflict with the CAPI controller webhook • There does not seem to be a way to tell rancher to only watch certain CAPI Resources If this feature flag exists, that would be really helpful for my use case: disabling RKE2 and the associated Rancher capi controllers.

crooked-cat-21365

01/13/2023, 6:57 AM

On migrating Rancher from RKE to RKE2 (both 1.24.8), is there some kind of dry run mode to very the backup in advance, before shutting down the RKE cluster?

bland-translator-58922

01/13/2023, 8:42 AM

Hello, I'm encountering some errors when upgrading from 2.6.9 to 2.7.0. When running:

helm upgrade rancher rancher-stable/rancher --namespace cattle-system --set hostname=REDACTED --version=2.7.0

I get the following error:

Error: UPGRADE FAILED: unable to recognize "": no matches for kind "Issuer" in version "<http://cert-manager.io/v1|cert-manager.io/v1>"

loud-receptionist-98355

01/13/2023, 12:51 PM

Hi, how does one get the Rancher Node resource unstuck from this state?

bitter-account-51613

01/13/2023, 1:41 PM

Hello, We recently upgrade one node in cluster from debian 10 to debian 11 and pods in this node dont have network connection right now. K8s version 1.21.1 Any ideas?

quiet-arm-5251

01/13/2023, 1:50 PM

Hello, does Rancher v2.7 support k8s v1.25?

straight-oil-38150

01/13/2023, 3:10 PM

Hello

straight-oil-38150

01/13/2023, 3:10 PM

Does exist support in portuguese here?

straight-oil-38150

01/13/2023, 3:12 PM

Does rancher v2.7 support RBAC permissions?

straight-oil-38150

01/13/2023, 3:12 PM

I'm trying to restrict access for new users from JumpCloud IdP but doesn't work

curved-lifeguard-39360

01/13/2023, 3:49 PM

I am working on a way to script the rollout of a rancher cluster. I have successful completed all steps, but I want to be able to create users and cloud credentials using kubectl. How can that be done?

mysterious-accountant-96734

01/13/2023, 5:22 PM

Hi all, I am installing rancher in a lab where all internet access is intercepted by a proxy which then provides an internally signed certificate. I am installing this on a vsphere environment. I have installed the certificates on the VM template being used and have installed rancher using the helm options --set additionalTrustedCAs=true, followed by the creation of the secret containing the additional cas (as per https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#additional-trusted-cas). YET I noticed that when I create new clusters on rancher, the new certificates are not inherited and used by the new clusters. In fact adding a new repo on rancher to the newly created cluster gives "Git clone --depth=1 -n http://git.rancher.io/rke2-charts .... SSL certificate problem: unable to get local issuer certificate ...". How can one add custom certificates to the new rancher clusters ?

brave-pilot-1886

01/13/2023, 6:51 PM

Hello, do I need to do something in order to support quay.io registry (using rancher desktop with nerdctl)?

brave-pilot-1886

01/13/2023, 6:51 PM

Copy code

INFO[0009] trying next host                              error="failed to do request: Head \"<https://quay.io/v2/keycloak/keycloak/manifests/latest>\": proxyconnect tcp: dial tcp 127.0.0.1:3128: connect: connection refused" host=<http://quay.io|quay.io>
ERRO[0009] server "<http://quay.io|quay.io>" does not seem to support HTTPS  error="failed to resolve reference \"<http://quay.io/keycloak/keycloak:latest\|quay.io/keycloak/keycloak:latest\>": failed to do request: Head \"<https://quay.io/v2/keycloak/keycloak/manifests/latest>\": proxyconnect tcp: dial tcp 127.0.0.1:3128: connect: connection refused"

brave-pilot-1886

01/13/2023, 7:04 PM

also on docker registry

best-address-42882

01/13/2023, 7:26 PM

Hey, does it possible use banded apps tools in air-gapped rancher for imported RKE2 cluster? I see tools available for local cluster, but it's doesn't seems available for imported.

adventurous-mechanic-95332

01/15/2023, 6:39 AM

hey, is there a plan to integrate lgtm stack as rancher default monitoring solution (Loki, grafana,tempo, minor) ? Thx.

little-father-84244

01/15/2023, 11:37 AM

hey, im trying to allow read-only users to view metrics of pods I tried adding those to my rule

Copy code

- apiGroups:
  - <http://catalog.cattle.io|catalog.cattle.io>
  resources:
  - apps
  verbs:
  - list
- apiGroups:
  - '*'
  resources:
  - services/proxy
  verbs:
  - create

but I can't see the metrics tab what is the correct configuration? (it's works if I am using * on apigroups and resources)