VestigeJ
commented
2 months ago Looks like there was indeed something wrong with the AMI that I had used at the time - re-testing the non-rc non-testing rpm channel results in a healthy node
NAME STATUS ROLES AGE VERSION
node/ip-ip.us-east-2.compute.internal Ready control-plane,etcd,master 2m46s v1.27.16+rke2r2
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system pod/cilium-ctq6t 1/1 Running 0 2m12s
kube-system pod/cilium-envoy-slffr 1/1 Running 0 2m12s
kube-system pod/cilium-operator-68f6b788c4-8ss86 0/1 Pending 0 2m12s
kube-system pod/cilium-operator-68f6b788c4-pmxwb 1/1 Running 0 2m12s
kube-system pod/cloud-controller-manager-ip-ip.us-east-2.compute.internal 1/1 Running 0 2m33s
kube-system pod/etcd-ip-ip.us-east-2.compute.internal 1/1 Running 0 2m39s
kube-system pod/helm-install-rke2-cilium-mbjwq 0/1 Completed 0 2m24s
kube-system pod/helm-install-rke2-coredns-r4vjw 0/1 Completed 0 2m24s
kube-system pod/helm-install-rke2-ingress-nginx-z9wp8 0/1 Completed 0 2m24s
kube-system pod/helm-install-rke2-metrics-server-vx7lf 0/1 Completed 0 2m23s
kube-system pod/helm-install-rke2-multus-sfgrh 0/1 Completed 0 2m21s
kube-system pod/helm-install-rke2-snapshot-controller-26j6p 0/1 Completed 0 2m20s
kube-system pod/helm-install-rke2-snapshot-controller-crd-4jq69 0/1 Completed 0 2m21s
kube-system pod/helm-install-rke2-snapshot-validation-webhook-krnc4 0/1 Completed 0 2m20s
kube-system pod/kube-apiserver-ip-ip.us-east-2.compute.internal 1/1 Running 0 2m33s
kube-system pod/kube-controller-manager-ip-ip.us-east-2.compute.internal 1/1 Running 0 2m35s
kube-system pod/kube-proxy-ip-ip.us-east-2.compute.internal 1/1 Running 0 2m32s
kube-system pod/kube-scheduler-ip-ip.us-east-2.compute.internal 1/1 Running 0 2m35s
kube-system pod/rke2-coredns-rke2-coredns-864fbd7785-gfpbj 1/1 Running 0 2m13s
kube-system pod/rke2-coredns-rke2-coredns-autoscaler-6c87968579-g5x49 1/1 Running 0 2m13s
kube-system pod/rke2-ingress-nginx-controller-9lnck 1/1 Running 0 41s
kube-system pod/rke2-metrics-server-7f745dbddf-mwwsp 1/1 Running 0 64s
kube-system pod/rke2-multus-7mwwm 1/1 Running 3 (99s ago) 2m14s
kube-system pod/rke2-snapshot-controller-7d6476d7cb-6x8sv 1/1 Running 0 65s
kube-system pod/rke2-snapshot-validation-webhook-5649fbd66c-6prm9 1/1 Running 0 64s
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
default service/kubernetes ClusterIP 10.43.0.1 <none> 443/TCP 2m46s
kube-system service/rke2-coredns-rke2-coredns ClusterIP 10.43.0.10 <none> 53/UDP,53/TCP 2m13s
kube-system service/rke2-ingress-nginx-controller-admission ClusterIP 10.43.224.147 <none> 443/TCP 41s
kube-system service/rke2-metrics-server ClusterIP 10.43.214.172 <none> 443/TCP 64s
kube-system service/rke2-snapshot-validation-webhook ClusterIP 10.43.114.248 <none> 443/TCP 64s
Environmental Info: RKE2 Version:
Node(s) CPU architecture, OS, and Version:
$ uname -a
Cluster Configuration:
Singe server with selinux set to enforcing
Describe the bug:
Steps To Reproduce:
Expected behavior:
$ sudo INSTALL_RKE2_VERSION=$VERSION INSTALL_RKE2_CHANNEL=testing INSTALL_RKE2_METHOD=rpm INSTALL_RKE2_EXEC=server ./install-rke2.sh
install single node with rke2 profile: cis, selinux: true with any CNI on Oracle 9.4 AMI and selinux set to enforcing
Actual behavior:
Oracle 9.4 with selinux enabled doesn't seem to have the right permissions to stand up the networking stack and interfaces on the node aren't created for the chosen CNI.
Additional context / logs:
When you remove the selinux db the cluster is capable of starting albeit still in a broken state it seeeeems there may be crossover with some previous issues https://github.com/rancher/rke2/issues/1865
//typical journalctl output $ sudo journalctl -u rke2-server -f
$ sudo audit2allow -w -a