This message was deleted.

Sorry for stating the obvious, but with a new cluster on a new set of machines, have all the firewall restrictions been matched with what was on the working on the old cluster?

Thanks, no worries — I fully understand that it’s important to re-check the basics. All firewall restrictions are disabled, exactly the same as on the previous working cluster. Also and Update: After many attempts (rebuilding the machines and recreating the cluster from scratch several times), I finally found one thing that made the installation progress on the nodes: I had to assign all roles (etcd, control-plane, and worker) to the first node I deployed. This is strange because in my previous cluster I didn’t need to do this at all — I only selected

etcd

+

control-plane

since this node was meant to be a master only (no worker role), and everything worked perfectly. Interestingly, after setting all roles for the first node, I could create the remaining master nodes exactly as before (only

etcd

+

control-plane

), and they joined without any issue. So I’m not sure why the process behaves differently in some situations and not in others. Also, I still can’t figure out where to look beyond the

system-agent-install

log, which doesn’t provide any helpful information about what is blocking the install. If you have any suggestions on deeper logs or components I should check, especially in an air-gapped setup, I’d really appreciate it.

Again, back to basics (and sorry): you said in the first post that you ran the registration script on the hosts (plural). In the second, you said you set one host to have worker node as well as etcd and control plane and it went through for the other master nodes, without mentioning worker nodes. Had any nodes been set to worker on the first run through, since Rancher won't install without all three aspects in place in the cluster?

Thanks for the follow-up — let me clarify the behavior I’m seeing in a structured way. A few weeks ago, I built my first RKE2 cluster in the same air-gapped environment. For that cluster, I added the first node with only the

etcd

and

control-plane

roles (since it was meant to be a dedicated master). The system agent installed successfully, the node registered, and everything progressed normally. After that, I added the rest of the nodes: • 3 masters →

etcd

+

control-plane

• 3 workers →

worker

only The entire cluster deployed without any issues. ---- What happened in the new cluster: When I attempted to build a new cluster a few weeks later — using the same OS version, same scripts, and same air-gap artifacts — the first node would not complete the agent installation if I assigned only

etcd

+

control-plane

, exactly as I did before. No matter how long I waited or how many times I recreated the machines and the cluster, the system-agent logs would only show the two lines I mentioned earlier, and the installation never progressed. The only way I could get the first node to proceed was to assign all roles (etcd + control-plane + worker) to that initial node. Once I did that, the installation completed successfully. After that, I was able to add the remaining nodes exactly as before: • 1 master with all roles (only the first node — not desired) • 2 additional masters →

etcd

+

control-plane

• 3 workers →

worker

only So the second cluster eventually deployed, but only with this workaround. Additional notes • This behavior was consistent — I reproduced it several times with a completely fresh cluster and new VMs. • Although this workaround allowed the installation to continue, it feels incorrect, and I am now left with a master node that also has the

worker

role assigned, which I don’t actually want — and I haven’t found a way to remove that role afterward. Given that the first cluster deployed perfectly without needing the first node to act as a worker, the inconsistency is puzzling. If you have insight into why the system agent would stall unless all roles are assigned on the first node, or if there are deeper logs I should look at beyond

system-agent-install

, I’d appreciate any guidance.