[release-1.20] RKE2 CIS checks expect etcd user on agents

[Martin-Weiss]

Environmental Info:
RKE2 Version:

rke2 version v1.20.7+rke2r2 (ea65147)
go version go1.15.8b5

Node(s) CPU architecture, OS, and Version:
SLES 15 SP2

Cluster Configuration:
3 Server, 14 Agents

Describe the bug:
During deployment of agents we see this in journalctl -u rke2-agent:

May 26 10:51:07 dehwllk8p01n005 systemd[1]: Starting Rancher Kubernetes Engine v2 (agent)...
May 26 10:51:07 dehwllk8p01n005 systemd[1]: Started Rancher Kubernetes Engine v2 (agent).
May 26 10:51:07 dehwllk8p01n005 rke2[37988]: time="2021-05-26T10:51:07+02:00" level=fatal msg="missing required user: unknown user etcd\n"
May 26 10:51:07 dehwllk8p01n005 systemd[1]: rke2-agent.service: Main process exited, code=exited, status=1/FAILURE
May 26 10:51:07 dehwllk8p01n005 systemd[1]: rke2-agent.service: Unit entered failed state.
May 26 10:51:07 dehwllk8p01n005 systemd[1]: rke2-agent.service: Failed with result 'exit-code'.
May 26 10:51:12 dehwllk8p01n005 systemd[1]: rke2-agent.service: Service RestartSec=5s expired, scheduling restart.

This is our config.yaml

private-registry: /etc/rancher/rke2/registries.yaml
token: <token>
server: https://<master-node>:9345
profile: cis-1.6
node-label:
  - "cluster=<clustername>"
  - "role=storage-node"

Steps To Reproduce:

• Installed RKE2 with cis-1.6 with three masters and add an agent with a similar config.yaml as above

Expected behavior:

• on agents an etcd user should not be expected or required - we just need that user on the masters / on the etcd nodes.

Actual behavior:

• rke2 binary expects etcd user on agents

[brandond]

Added a callout in the 1.20.7+rke2r2 release notes. Will be fixed in 1.20.8.

[Fabyao]

@brandond Is there a workaround until release 1.20.8?

[Fabyao]

@brandond Ignore me just seen this in the release notes:
CIS Profile checks require etcd user to be present on agents. As a workaround, ensure that the etcd user exists on all nodes on which you will use the --profile flag, even ones that you do not plan to enable etcd on. This will be fixed in a subsequent patch release.

[rancher-max]

Validated in v1.20.8-rc1+rke2r1

• etcd user is not required anymore on agents
• clusters still pass cis checks