https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# rke2
a
This message was deleted.
n
They are not mutually exclusive. The docs should be updated to improve readability.
So for you case, you would have:
Copy code
profile: cis-1.23
pod-security-admission-config-file: /path/to/my/custom/pss.yaml
You can see here in the code how if we see a 
pod-security-admission-config-file
flag, we not write the default pss.yaml, but there are other steps/operations we take if we see 
profile: cis-XX
as well.
Also I should note that in newer releases of RKE2, we introduced a generic 
profile: cis
which should make upgrading in the future easier. The idea is that whatever verion of K8s you are on, the associated cis profile tests will pass. CIS has swapped back and forth between tracking upstream (ie K8s 1.23 has a cis-1.23 benchmark) and is now back to a more generic versions (K8s 1.26+ using cis-1.7 and I believe 1.28+ using cis-1.8).
f
Ok, that's cool. I see how it's supposed to work. Doesn't fully explain what I saw in practice, but I must have made an error somewhere . I could have sworn when I installed with both values in the config it still created the default rke2-pss.yaml. That was on 1.25.7. I'll do some more testing in the new year, and check the release notes see of there was a bug fix for a minor version or something. Will be good to get to the generic 'cis' thing, much easier. Having to stay a few versions behind though waiting for Rancher compatibility to catch up. Thanks for your prompt response.
n
Yeah Rancher is slower to support new K8s versions, but we did introduce the generic profile in 1.25.14, so you might have it supported depending on your rancher version. I will double check 1.25.7
I validated that it works with 1.25.7, if you want to see what arguments 
kube-apiserver
is launching with, the 
journalctl
logs around 
Running kube-apiserver
seem incomplete. Check 
/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
which is actually what gets launched by RKE2.
f
That's great, thanks. I was looking at the pod describe for the api server, bit that's a good tip. I'll do some more testing. Thanks very much for your help.
16 Views
Open in Slack
PreviousNext
Powered by