Folks - regarding the k3s upgrade controller - there's an air-gapped k3s install scenario but - no corresponding air-gapped upgrade using the upgrade controller that I can see. E.g. if the Plan CRD offered a way to locate the binary/binaries on a local machine via SSH, or maybe S3 bucket running on a local Minio, or a persistent volume, etc. - that would support an air-gapped upgrade. Has anyone at Rancher given consideration to this?

the upgrade doesn’t NEED to go out to the internet. If you specify the target version in the plan, and have the matching tag available in your private registry or preloaded onto the node, it will just work. Have you actually tried it yet?

I was - I was thinking that the k3s service binary would need to be updated / replaced PLUS any images - is that incorrect?

yep. I wouldn’t try it unless you’re using a registry mirror or have a very easy process to import tarballs on all your nodes… but everything you need is available.

interesting. I will experiment with it - thanks

like I said above, the k3s service binary is in the k3s-upgrade image. It does not download it from the internet.

right I inferred that. I will experiment with it - intuitively it seems like the upgrade would be easier if you could "point" the plan to a storage location with the needed tarballs but - I should work through the upgrade process in an air-gapped way before saying that - which I will do

tarballs are just a convenient way to move around multiple images. At the end of the day the plan itself doesn’t care about tarballs or anything else, it just needs the images to be available - either preloaded into the containerd image store on every node, or on a registry mirror that the nodes can pull from.