If I used

rke2-ansible

to install an upstream cluster, can I continue to use ansible for modifications like adding `cis` to the configuration ? Or would it be better to manage the config.yaml file some other way? I understand that the Rancher System Upgrade Controller is a thing, but it’s rather alot to digest & I’ve only just started reading the documentation for it.

SUC is just good for changing versions, not for managing configuration.

Is there a tool that is good for both managing configuration & changing versions?

For standalone clusters, just your automation / desired-state-configuration tool of choice. But really this sort of thing is why Rancher exists - to manage provisioning, configuration, and version of many clusters.

Right: But Rancher doesn’t do much RKE2 management on the upstream cluster; I need to build that first, then install Rancher on top of it. Rancher manages downstream clusters well, but I’m trying to figure out Rancher’s intended tools for RKE2 on the upstream cluster.

Rancher does not currently suggest any tools for managing configuration of the local cluster. How you manage the cluster that Rancher is deployed to is up to you to decide, based on what fits your environment best.