Hi, I have RKE2 v1.22.9 with rke2-canal. As the operating system supports ipset 7.15 I'm facing the issue of it not being compatible with hardened calico ipset. According to the tigera documentation, the latest image supports ipset 7.11 which is still incompatible with 7.15. As I'm not using any of the extra security features of hardened-calico (not even sure why I went with this in the first place), I would like to replace it. I've done a CNI replacement in a different cluster (EKS, replaced the stock CNI with weave), but I'm not sure what is the procedure here (if possible). Tigera documentation mentions a possible migration path from canal to calico, but does that apply here? The CNI was installed as part of the RKE2 installation. Does replacing the CNI break anything in the cluster?

What OS are you using?

I'm using openSuSE microOS.

I need to investigate this, can you point me to the tigera docs where the ipset version is mentioned?

https://projectcalico.docs.tigera.io/release-notes/ shows ipset 7.11 support. The exact error message I see in the rke2-calico logs: 2022-10-08 18:45:14.601 [INFO][31580] felix/ipsets.go 312: Retrying after an ipsets update failure... family="inet" 2022-10-08 18:45:14.602 [ERROR][31580] felix/ipsets.go 574: Bad return code from 'ipset list'. error=exit status 1 family="inet" stderr="ipset v7.1: Kernel and userspace incompatible: settype hash:ip with revision 5 not supported by userspace.\n" 2022-10-08 18:45:14.602 [WARNING][31580] felix/ipsets.go 322: Failed to resync with dataplane error=exit status 1 family="inet" This repeats endlessly. About the migration issue: I see no such messages in the calico-node pod on one of my other clusters. The above messages only appear in the one one with the rke2-canal installation.

let me try to reproduce it

Thanks for the time you take on this.

worker1:/etc # cat os-release

NAME="openSUSE MicroOS"

# VERSION="20220611"

ID="opensuse-microos"

ID_LIKE="suse opensuse opensuse-tumbleweed"

VERSION_ID="20220611"

PRETTY_NAME="openSUSE MicroOS"

ANSI_COLOR="0;32"

CPE_NAME="cpe:/o:opensuse:microos:20220611"

BUG_REPORT_URL="<https://bugs.opensuse.org>"

HOME_URL="<https://www.opensuse.org/>"

DOCUMENTATION_URL="<https://en.opensuse.org/Portal:MicroOS>"

LOGO="distributor-logo-MicroOS"

thanks, that's pretty new! Note that the OS not under the support matrix https://docs.rke2.io/install/requirements/#operating-systems

That site does not even mention openSuSE microOS, just the SLE microOS. I failed to find how my microOS version relates to the SLE microOS

you should rather use openSUSE Leap Micro indeed

Thank. Am I correct in that Leap Micro does not have a 5.1 version?

no it does not, but you should stay away 5.1 which is soon EOL

That's exactly what I wanted to ask, but you were faster