From 408b363e058904cdfea061a0d811675dbec4ac43 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 8 Aug 2026 17:51:49 +1000
Subject: [PATCH] fix: preload correct rke2 airgap images to break CNI
 bootstrap deadlock

New el9_8 nodes boot rke2 v1.33.11 (flannel v0.28.4 / calico v3.31.5) from
the rolling latest/1.33 repo, but the airgap preload pinned v1.33.4
(flannel v0.27.2 / calico v3.30.2), so canal's images were never on disk and
containerd fell back to the artifactapi mirror VIP, which is unreachable until
the flannel overlay it would provide is up. Classic bootstrap deadlock.

- bump pinned rke2_version 1.33.4 -> 1.33.11 so the versionlock, RPM and
  preloaded tarball all match the canal image tags the running binary requests
- preload the canal-specific tarball alongside the default bundle so the
  flannel/calico images are guaranteed on disk regardless of bundle layout

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
---
 modules/rke2/manifests/install.pp | 21 ++++++++++++---------
 modules/rke2/manifests/params.pp  |  2 +-
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp
index f15764d..4b89c06 100644
--- a/modules/rke2/manifests/install.pp
+++ b/modules/rke2/manifests/install.pp
@@ -27,15 +27,18 @@ class rke2::install (
     before  => Service["rke2-${node_type}"],
   }
 
-  # download required archive of containers
-  archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
-    ensure  => present,
-    source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
-    require => [
-      Package["rke2-${node_type}"],
-      File['/var/lib/rancher/rke2/agent/images'],
-    ],
-    before  => Service["rke2-${node_type}"],
+  # preload airgap tarballs (incl. canal CNI) so flannel/calico start from disk, not the mirror VIP that needs flannel to be reachable
+  $image_archives = ['rke2-images.linux-amd64.tar.zst', 'rke2-images-canal.linux-amd64.tar.zst']
+  $image_archives.each |String $archive_file| {
+    archive { "/var/lib/rancher/rke2/agent/images/${archive_file}":
+      ensure  => present,
+      source  => "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download/v${rke2_version}%2B${rke2_release}/${archive_file}",
+      require => [
+        Package["rke2-${node_type}"],
+        File['/var/lib/rancher/rke2/agent/images'],
+      ],
+      before  => Service["rke2-${node_type}"],
+    }
   }
 
   # ensure the images cache file exists
diff --git a/modules/rke2/manifests/params.pp b/modules/rke2/manifests/params.pp
index 4c110dc..9d5a443 100644
--- a/modules/rke2/manifests/params.pp
+++ b/modules/rke2/manifests/params.pp
@@ -1,7 +1,7 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.4',
+  String                  $rke2_version = '1.33.11',
   String                  $rke2_release = 'rke2r1',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},