https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# rke2
a
This message was deleted.
o
Throttling by Docker? Their free anonymous tier is meager.
n
Rancher images are not throttled by Docker, there is an agreement between SUSE (Rancher) and Docker Inc
Generally its a networking issue if you can't pull images.
f
I didn't try to install docker on this machine to test docker pull. Generally machine can reach internet. 
curl -sfL <https://get.rke2.io> --output install.sh
works fine and 
yum update
works too. It's strange that rke is unable to pull images from index.docker.io
It's an isolated issue by the way because I didn't have this problem with ubuntu at all
c
you truncated the log messages so we can’t see what the error is, but you should be able to see what the message is and work on addressing that.
Get \"<https://index.docker.io/v2/>\": dial tcp 35.16>
from the little bit you did share it looks like it just can’t connect.
f
Yes this is right! @creamy-pencil-82913. I understand VMs are in data center where I don't have all details about networking. No matter what I do including disabling network manager from managing flannel interfaces and disabling firewall-cmd, I always return to the error below. rke2-server will never start with systemd. I guess the only option left for me here is air-gapped install
Copy code
Nov 21 00:25:41 dla2-csmk8uat01-cp sh[256606]: + /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service
Nov 21 00:25:41 dla2-csmk8uat01-cp systemctl[256607]: Failed to get unit file state for nm-cloud-setup.service: No such file or directory
Nov 21 00:25:41 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:41+01:00" level=warning msg="not running in CIS mode"
Nov 21 00:25:41 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:41+01:00" level=info msg="Applying Pod Security Admission Configuration"
Nov 21 00:25:41 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:41+01:00" level=info msg="Starting rke2 v1.33.5+rke2r1 (d1092839cf08cb901b1d40461b0fa6e7ae6f8fc4)"
Nov 21 00:25:41 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:41+01:00" level=info msg="Managed etcd cluster initializing"
Nov 21 00:25:43 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:43+01:00" level=info msg="Password verified locally for node dla2-csmk8uat01-cp"
Nov 21 00:25:43 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:43+01:00" level=info msg="certificate CN=dla2-csmk8uat01-cp signed by CN=rke2-server-ca@1763681103: notBefore=2025-11-20 23:25:03 +0000 UTC notAfter>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="certificate CN=system:node:dla2-csmk8uat01-cp,O=system:nodes signed by CN=rke2-client-ca@1763681103: notBefore=2025-11-20 >
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="certificate CN=system:kube-proxy signed by CN=rke2-client-ca@1763681103: notBefore=2025-11-20 23:25:03 +0000 UTC notAfter=>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="certificate CN=system:rke2-controller signed by CN=rke2-client-ca@1763681103: notBefore=2025-11-20 23:25:03 +0000 UTC notA>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Module overlay was already loaded"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Module nf_conntrack was already loaded"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Module br_netfilter was already loaded"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Module iptable_nat was already loaded"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Module iptable_filter was already loaded"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=warning msg="Failed to load kernel module nft-expr-counter with modprobe"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Checking local image archives in /var/lib/rancher/rke2/agent/images for <http://index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r|index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r>>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=warning msg="Failed to load runtime image <http://index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r1|index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r1> from tarball: no local image available>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Checking local image archives in /var/lib/rancher/rke2/agent/images for <http://index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r|index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r>>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=warning msg="Failed to load runtime image <http://index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r1|index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r1> from tarball: no local image available>
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Pulling runtime image <http://index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r1|index.docker.io/rancher/rke2-runtime:v1.33.5-rke2r1>"
Nov 21 00:25:44 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:25:44+01:00" level=info msg="Waiting for cri connection: rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing>
Nov 21 00:26:04 dla2-csmk8uat01-cp rke2[256610]: time="2025-11-21T00:26:04+01:00" level=info msg="Waiting for cri connection: rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing>
c
you’re still truncating the logs to terminal width, this shows even LESS than before.
But yes, if you can’t get to Docker Hub then you’ll need to use airgap image tarballs, or set up a registry mirror. Not really any way around that.
f
That is about the major part where things fall apart. Everything up until that point works fine
c
yes, this is the part where it needs the rke2-runtime image from a registry or airgap tarball.
Fix your network, use a mirror, or use airgap tarballs.
f
I will try mirror. I don't know how to go about that yet. But I will figure. will appreciate if you have an online doc or guide. The air-gap install is not very reproducible across other linux distro or run easily in a pipeline for another environment . This is why I am trying to get online method to work on oracle server. But now, there isn't any other way
c
You don’t need to do the full airgap install if all you need is the images
just grab whatever tarball files from the release page on GH and drop them in the images dir on your nodes
but if you are setting up multiple nodes, having a local mirror is probably less work since the images are a lot to be copying around.
💯 1
f
my UAT environment is just 3 nodes. Prod will be 8 nodes. Even then the registry setup is a lot of hassle for me. And I couldn't get it to work after hours of troubleshooting. Each installation effort always results into one or two images missing from my private registry even after about 70 images have been loaded, leading to 
systemctl restart
constantly failing. I just grabbed the tarball single file, dropped in images folder and that was it! Thanks. I really do like to use private registry as I intend to use it as container registry for CICD but I don't have a lot of time in my hands to further troubleshoot or research
55 Views
Open in Slack
PreviousNext
Powered by