unkinben
7eee7e7415
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
## Why
k8s nodes fail every puppet run on Package[rke2-server] and stop
applying the rest of their catalog (no further package/config updates):
change from '1.33.4~rke2r1-1.el9' to '1.33.11~rke2r1' failed:
dnf upgrade rke2-server-1.33.11~rke2r1 returned 1:
Problem: problem with installed package rke2-common-1.33.13~rke2r2-0.el9
- package rke2-server-1.33.11~rke2r1 requires rke2-common = 1.33.11~rke2r1,
but none of the providers can be installed
- cannot install the best update candidate for rke2-server
The module versionlocks only rke2-server/rke2-agent, not their strict
(= version) rke2-common dependency. rke2-common is pulled from the
rolling rancher-rke2-1.33-latest channel, whose head is now
1.33.13~rke2r2, so rke2-common drifted up to 1.33.13~rke2r2 while the
pin sat at 1.33.11~rke2r1. dnf upgrade can't downgrade the newer
rke2-common to satisfy the older server, so the transaction fails.
## Changes
- Versionlock rke2-common to the same ${rke2_version}~${rke2_release} as
the server/agent, so the rolling channel can no longer drift the
dependency ahead of the pin.
- Bump rke2_version 1.33.11 -> 1.33.13 and rke2_release rke2r1 -> rke2r2
to match the current channel head (and the already-drifted installed
rke2-common), so the pinned server/agent, versionlocks, and preloaded
airgap bundle all resolve in one transaction.
60 lines
1.9 KiB
Puppet
60 lines
1.9 KiB
Puppet
# install rke2
|
|
class rke2::install (
|
|
Enum['server', 'agent'] $node_type = $rke2::node_type,
|
|
String $rke2_version = $rke2::rke2_version,
|
|
String $rke2_release = $rke2::rke2_release,
|
|
Stdlib::HTTPUrl $container_archive_source = $rke2::container_archive_source,
|
|
){
|
|
|
|
# versionlock rke2
|
|
yum::versionlock{"rke2-${node_type}":
|
|
ensure => present,
|
|
version => "${rke2_version}~${rke2_release}",
|
|
}
|
|
|
|
# lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent
|
|
yum::versionlock{'rke2-common':
|
|
ensure => present,
|
|
version => "${rke2_version}~${rke2_release}",
|
|
}
|
|
|
|
# install rke2
|
|
package {"rke2-${node_type}":
|
|
ensure => "${rke2_version}~${rke2_release}",
|
|
}
|
|
|
|
# ensure images path exists
|
|
file { ['/var/lib/rancher/rke2/agent', '/var/lib/rancher/rke2/agent/images']:
|
|
ensure => 'directory',
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0750',
|
|
require => Package["rke2-${node_type}"],
|
|
before => Service["rke2-${node_type}"],
|
|
}
|
|
|
|
# preload the airgap bundle (has the default canal CNI images) so canal starts from disk, not the mirror VIP that needs flannel first
|
|
archive { '/var/lib/rancher/rke2/agent/images/rke2-images.linux-amd64.tar.zst':
|
|
ensure => present,
|
|
source => "${container_archive_source}/v${rke2_version}%2B${rke2_release}/rke2-images.linux-amd64.tar.zst",
|
|
require => [
|
|
Package["rke2-${node_type}"],
|
|
File['/var/lib/rancher/rke2/agent/images'],
|
|
],
|
|
before => Service["rke2-${node_type}"],
|
|
}
|
|
|
|
# ensure the images cache file exists
|
|
file {'/var/lib/rancher/rke2/agent/images/.cache.json':
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
require => [
|
|
Package["rke2-${node_type}"],
|
|
File['/var/lib/rancher/rke2/agent/images'],
|
|
],
|
|
before => Service["rke2-${node_type}"],
|
|
}
|
|
}
|