CNI version and configuration upgrades

[febus982]

• Do RKE2 updates also upgrade the installed CNI charts? (e.g. cilium from 1.14 to 1.15)

• Is it possible to change the relevant HelmChartConfig after the CNI plugin has been installed? (e.g. enabling Hubble after the cluster is up and running)

# /var/lib/rancher/rke2/server/manifests/rke2-cilium-config.yaml
---
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-cilium
  namespace: kube-system
spec:
  valuesContent: |-
    hubble:
      enabled: true
      relay:
        enabled: true
      ui:
        enabled: true

[manuelbuil]

Yes, it should upgrade the installed CNI charts

[manuelbuil]

And yes, you can change the config after it has been installed. The controller will apply the new config after some seconds

[febus982]

Hey @manuelbuil , I know this has been already answered but could I ask for some more information about the used charts?

I have explored around in the repository and my understanding is all the Helm charts used for the CNIs and the other components are hosted at https://rke2-charts.rancher.io/

If I were to disable some of the components during the RKE2 installation and then manually install them using the charts would I achieve the same result?

Context:
I will be installing the rest of the cluster applications using FluxCD and it would be great having all the chart configurations together and managed by the same system.

It would also be easier to update each component without having to wait until RKE2 updates itself.

[brandond]

If I were to disable some of the components during the RKE2 installation and then manually install them using the charts would I achieve the same result?

No. Charts that are present during system startup get cluster configuration values injected into them. If you tried to manually deploy them later, you would need to set the same values by hand. Ref:

rke2/pkg/bootstrap/bootstrap.go

Lines 302 to 318 in eb2d438

	// setChartValues scans the directory at manifestDir. It attempts to load all manifests
	// in that directory as HelmCharts. Any manifests that contain a HelmChart are modified to
	// pass through settings to both the Helm job and the chart values.
	// NOTE: This will probably fail if any manifest contains multiple documents. This should
	// not matter for any of our packaged components, but may prevent this from working on user manifests.
	func setChartValues(manifestsDir string, nodeConfig *daemonconfig.Node, cfg cmds.Agent) error {
	chartValues := map[string]string{
	"global.clusterCIDR": util.JoinIPNets(nodeConfig.AgentConfig.ClusterCIDRs),
	"global.clusterCIDRv4": util.JoinIP4Nets(nodeConfig.AgentConfig.ClusterCIDRs),
	"global.clusterCIDRv6": util.JoinIP6Nets(nodeConfig.AgentConfig.ClusterCIDRs),
	"global.clusterDNS": util.JoinIPs(nodeConfig.AgentConfig.ClusterDNSs),
	"global.clusterDomain": nodeConfig.AgentConfig.ClusterDomain,
	"global.rke2DataDir": cfg.DataDir,
	"global.serviceCIDR": util.JoinIPNets(nodeConfig.AgentConfig.ServiceCIDRs),
	"global.systemDefaultRegistry": nodeConfig.AgentConfig.SystemDefaultRegistry,
	"global.cattle.systemDefaultRegistry": nodeConfig.AgentConfig.SystemDefaultRegistry,
	}

If you want to disable all the stuff that comes with RKE2 and deploy replacements by hand you are welcome to do so, but it's not something we support. Basically, if you do this and something breaks, you get to keep both pieces.