From ff1a30823c3876c6e49f2b36f9c682521dcecce4 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 8 Aug 2026 23:13:40 +1000 Subject: [PATCH] fix: lock rke2-common and pin rke2 to 1.33.13~rke2r2 to unblock puppet (#516) ## Why Every puppet run on k8s nodes (e.g. prodnxsr0002) fails on `Package[rke2-server]` and stops applying the rest of the catalog, so the nodes stop receiving all further package/config updates: ``` change from '1.33.4~rke2r1-1.el9' to '1.33.11~rke2r1' failed: Could not update: dnf upgrade rke2-server-1.33.11~rke2r1 returned 1: Problem: problem with installed package rke2-common-1.33.13~rke2r2-0.el9.x86_64 - package rke2-server-1.33.11~rke2r1 requires rke2-common = 1.33.11~rke2r1, but none of the providers can be installed - cannot install the best update candidate for package rke2-server ``` `rke2::install` versionlocks only `rke2-server`/`rke2-agent`, never their strict (`= version`) `rke2-common` dependency. `rke2-common` is served from the rolling `rancher-rke2-1.33-latest` channel, whose head is now `1.33.13~rke2r2`, so `rke2-common` drifted up to `1.33.13~rke2r2` while the pin (`#512`) sat at `1.33.11~rke2r1`. `dnf upgrade` cannot downgrade the newer `rke2-common` to satisfy the older server, so the transaction fails. This is the rolling-channel drift `#512` flagged as needing follow-up. ## How - Versionlock `rke2-common` to the same `${rke2_version}~${rke2_release}` as the server/agent, so the rolling channel can no longer drift the dependency ahead of the pin. - Bump `rke2_version` `1.33.11` -> `1.33.13` and `rke2_release` `rke2r1` -> `rke2r2` to match the current channel head and the already-drifted installed `rke2-common`, so the pinned server/agent, both versionlocks, and the preloaded airgap bundle resolve in one transaction. Verified against the live artifactapi rke2 remote: `rke2-server-1.33.13~rke2r2-0.el9.x86_64.rpm` and the `v1.33.13+rke2r2` `rke2-images.linux-amd64.tar.zst` airgap bundle both serve HTTP 200. Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/516 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- modules/rke2/manifests/install.pp | 6 ++++++ modules/rke2/manifests/params.pp | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp index 4630f3c..e472eac 100644 --- a/modules/rke2/manifests/install.pp +++ b/modules/rke2/manifests/install.pp @@ -13,6 +13,12 @@ class rke2::install ( before => Package["rke2-${node_type}"], } + # lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent + yum::versionlock{'rke2-common': + ensure => present, + version => "${rke2_version}~${rke2_release}", + } + # install rke2 package {"rke2-${node_type}": ensure => "${rke2_version}~${rke2_release}", diff --git a/modules/rke2/manifests/params.pp b/modules/rke2/manifests/params.pp index 9d5a443..cf92de4 100644 --- a/modules/rke2/manifests/params.pp +++ b/modules/rke2/manifests/params.pp @@ -1,8 +1,8 @@ # rke2 params class rke2::params ( Enum['server', 'agent'] $node_type = 'agent', - String $rke2_version = '1.33.11', - String $rke2_release = 'rke2r1', + String $rke2_version = '1.33.13', + String $rke2_release = 'rke2r2', Stdlib::Absolutepath $config_file = '/etc/rancher/rke2/config.yaml', Hash $config_hash = {}, Stdlib::HTTPSUrl $join_url = 'https://127.0.0.1:9345',