From 7eee7e7415a37d44f958b3ff38c22bcaf8a06342 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 8 Aug 2026 22:45:00 +1000
Subject: [PATCH] fix: lock rke2-common and pin rke2 to 1.33.13~rke2r2 to
 unblock puppet

## Why

k8s nodes fail every puppet run on Package[rke2-server] and stop
applying the rest of their catalog (no further package/config updates):

  change from '1.33.4~rke2r1-1.el9' to '1.33.11~rke2r1' failed:
  dnf upgrade rke2-server-1.33.11~rke2r1 returned 1:
  Problem: problem with installed package rke2-common-1.33.13~rke2r2-0.el9
   - package rke2-server-1.33.11~rke2r1 requires rke2-common = 1.33.11~rke2r1,
     but none of the providers can be installed
   - cannot install the best update candidate for rke2-server

The module versionlocks only rke2-server/rke2-agent, not their strict
(= version) rke2-common dependency. rke2-common is pulled from the
rolling rancher-rke2-1.33-latest channel, whose head is now
1.33.13~rke2r2, so rke2-common drifted up to 1.33.13~rke2r2 while the
pin sat at 1.33.11~rke2r1. dnf upgrade can't downgrade the newer
rke2-common to satisfy the older server, so the transaction fails.

## Changes

- Versionlock rke2-common to the same ${rke2_version}~${rke2_release} as
  the server/agent, so the rolling channel can no longer drift the
  dependency ahead of the pin.
- Bump rke2_version 1.33.11 -> 1.33.13 and rke2_release rke2r1 -> rke2r2
  to match the current channel head (and the already-drifted installed
  rke2-common), so the pinned server/agent, versionlocks, and preloaded
  airgap bundle all resolve in one transaction.
---
 modules/rke2/manifests/install.pp | 6 ++++++
 modules/rke2/manifests/params.pp  | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp
index 7c5b7b3..eab8f6c 100644
--- a/modules/rke2/manifests/install.pp
+++ b/modules/rke2/manifests/install.pp
@@ -12,6 +12,12 @@ class rke2::install (
     version => "${rke2_version}~${rke2_release}",
   }
 
+  # lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent
+  yum::versionlock{'rke2-common':
+    ensure  => present,
+    version => "${rke2_version}~${rke2_release}",
+  }
+
   # install rke2
   package {"rke2-${node_type}":
     ensure => "${rke2_version}~${rke2_release}",
diff --git a/modules/rke2/manifests/params.pp b/modules/rke2/manifests/params.pp
index 9d5a443..cf92de4 100644
--- a/modules/rke2/manifests/params.pp
+++ b/modules/rke2/manifests/params.pp
@@ -1,8 +1,8 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.11',
-  String                  $rke2_release = 'rke2r1',
+  String                  $rke2_version = '1.33.13',
+  String                  $rke2_release = 'rke2r2',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},
   Stdlib::HTTPSUrl        $join_url = 'https://127.0.0.1:9345',
-- 
2.47.3