RKE2 Config not working in 1.25+ #4392
-
Our team has been using mostly the same config for RKE2 versions 1.21.x -> 1.24.x without issue. With RKE2 1.25.x we removed the PodSecurityPolicy admission plugin and changed the CIS profile version to 1.23, however kubelet will not start. Removing the additional flags from the kublet args allows it start but breaks some security checks. We see the same behavior for other components if we remove the additional flags, then the components become healthy. Should we be setting these flags in a different way, via the --config option and file? Below is the config.yaml
See a bunch of warnings about setting config via flags and then kubelet exits and repeats
kublet.log
|
Beta Was this translation helpful? Give feedback.
Replies: 8 comments 3 replies
-
Removing additional config flags for components works fine and cluster components start and HA cluster created without issue
|
Beta Was this translation helpful? Give feedback.
-
Yes, you had some options in there that were no longer supported by the kubelet as of 1.25. If you add |
Beta Was this translation helpful? Give feedback.
-
Copy, so going forward (1.25 and >) use --config flag and add to a config file for all components? adding the |
Beta Was this translation helpful? Give feedback.
-
looking at https://v1-25.docs.kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ both the flags below are listed as DEPRECATED but should still be valid
Maybe I am missing something? |
Beta Was this translation helpful? Give feedback.
-
No, use the flag deprecation warnings. If you use a config file, you have to pass ALL the config via the file, as it ignores flags - and we still do all of our configuration via flags.
Yeah, those look OK. Can you paste the full logs from starting with the kubelet set to |
Beta Was this translation helpful? Give feedback.
-
will do, just note removed
|
Beta Was this translation helpful? Give feedback.
-
Added back
kubelet now fails to start. turned on
the below repeats
|
Beta Was this translation helpful? Give feedback.
-
Well I think I found answer, but would appreciate confirmation as seems to be some conflict in documentation of the status of the feature flag https://v1-25.docs.kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/ states the flag is GA in 1.25 which means you can't disable and would match the log error seen above the kubelet cli docs say its BETA https://v1-25.docs.kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ |
Beta Was this translation helpful? Give feedback.
The behavior matches the feature-gates documentation; I suspect it's the kubelet docs that are wrong. Is that enough confirmation?