When provisioning an RKE1 downstream cluster with io.cattle.cluster.cridockerd.enable set to false and enable_cri_dockerd set to true, the cluster successfully provisions when it shouldn't

[markusewalker]

Rancher Server Setup

• Rancher version: v2.6-head 2c21373
• Installation option (Docker install/Helm Chart): Helm Chart
  • If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
• Proxy/Cert Details:

Information about the Cluster

• Kubernetes version: v1.24.2-rancher1-1
• Cluster Type (Local/Downstream): Downstream
  • If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider): AWS

User Information

• What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom) Admin
  • If custom, define the set of permissions:

Describe the bug

When deploying a v1.24.2-rancher1-1 cluster with Rancher, I added the following annotation: io.cattle.cluster.cridockerd.enable and set it to be false. Additionally, I modified the cluster config's YAML to have enable_cri_dockerd set to be true. The expected output is that the annotation would override enable_cri_dockerd and cluster provisioning would fail.

However, that does not happen and provisioning is successful. Looking into why this happened, this specific combination, for whatever reason, causes the annotation to disappear from my list:

If I have this annotation set to false and do not modify enable_cri_dockerd in the YAML, the cluster does not provision as expected.

To Reproduce

1. Setup Rancher and navigate to the UI in a browser.
2. Provision a downstream RKE1 node driver cluster.
   • Add the annotation io.cattle.cluster.cridockerd.enable and give it the value false.
   • Edit the cluster configuration as YAML and change enable_cri_dockerd to have a value of true
3. Once you begin provisioning, note that the cluster does not fail and will eventually successfully provision.
4. Edit the cluster's configuration and view the annotations; you should see your added annotation disappear.

Result
The cluster should not provision with these conditions.

Expected Result
The cluster is successfully provisioning when it shouldn't.

[markusewalker]

While we wait for this issue to be addressed, here is the QA test plan:

QA TEST PLAN

Scenarios	Test Case
1	Fresh install: As a standard user, provision an RKE1 node driver cluster with io.cattle.cluster.cridockerd.enable set to false and enable_cri_dockerd set to true

[snasovich]

This is no longer relevant for K8s 1.24+ as the flag is now true by default.