Kubernetes version v1.22 fails to provision on RHEL8.4 SELinux on.

[vivek-shilimkar]

Rancher Server Setup

• Rancher version: v2.6-head
• Installation option (Docker install/Helm Chart): Docker

Information about the Cluster

• Kubernetes version: v1.22
• Cluster Type (Local/Downstream): Downstream
  • If downstream, what type of cluster?: Custom/Node Driver

Describe the bug

On RHEL8.4 SElinux On AWS AMI, the k8s version 1.22 fails to provision on AWS.

To Reproduce

1. Create a rancher server v2.6-head.
2. Try to provision a downstream k8s cluster with version v1.22 on RHEL8.4 SElinux On AWS AMI.

Result
Cluster provisioning fails with following error
[selinux] Host [172.31.18.232] does not recognize SELinux label [label=type:rke_container_t]. This is required for Kubernetes version [>=1.22.0-rancher0]. Please install rancher-selinux RPM package and try again

Expected Result

k8s cluster v1.22 provisions successfully.

[snasovich]

@vivek-infracloud , is this RKE1 or RKE2 provisioning?

[vivek-shilimkar]

@snasovich This is RKE1 provisioning.

[snasovich]

We're hitting the check implemented per https://github.com/rancher/rke/pull/2750/files#diff-1919f8e9dcce0dfe306c07bbda35bd2bab44635be0e5bbc473faabe062b0597cR71. The question is whether provisioning should automatically install rancher-selinux RPM package or the expectation is that it should be present on the node already (i.e. be "baked" into the AMI).

@snasovich to follow up with product management on this.

[snasovich]

After discussing with the product management the expectation is that Rancher is not going to install RPMs on the nodes, so the suggested approach is to either use AMI with this package already installed or have it installed via cloud-init.
This will need to be documented for 2.6.4 release, hence release-note label.

[snasovich]

This will need to be added to support matrix, adding area/support-matrix label.

[slickwarren]

talked with Sergey about this: we will also need to release note that the user will run into this issue when upgrading to 1.22 as well. For 2.6.4, we should release note that we are expecting users to manually upgrade/install the rancher-selinux package on all the nodes in that cluster, then upgrade k8s if upgrading to 1.22. @jtravee

[jtravee]

we are expecting users to manually upgrade/install the rancher-selinux package on all the nodes in that cluster, then upgrade k8s if upgrading to 1.22.

Added to existing issue in 2.6.4 RN, thanks!