Make RKE2 RPM repo STIG compliant

[caroline-suse-rancher]

rpm.rancher.io does not include a signature file for repomd.xml and RKE2 installer sets repo_gpgcheck = 0. We should fix this to make the repo STIG compliant.

Internal Ref: SURE-8821

Also, related issue - #7174

[caroline-suse-rancher]

PR working in rke2-selinux: rancher/rke2-selinux#79

[vitorsavian]

PR working in rke2-packaging: rancher/rke2-packaging#53

[vitorsavian]

Validation steps for SELinux and Rke2 RPMS

• While installing rke2 via rpms you will need to add a part for the rpms that's repo_gpgcheck=1

See the example for latest:

export RKE2_MINOR=28
export LINUX_MAJOR=7 # or 8 or 9 etc
cat << EOF > /etc/yum.repos.d/rancher-rke2-1-${RKE2_MINOR}-latest.repo
[rancher-rke2-common-latest]
name=Rancher RKE2 Common Latest
baseurl=https://rpm.rancher.io/rke2/latest/common/centos/${LINUX_MAJOR}/noarch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key

[rancher-rke2-1-${RKE2_MINOR}-latest]
name=Rancher RKE2 1.${RKE2_MINOR} Latest
baseurl=https://rpm.rancher.io/rke2/latest/1.${RKE2_MINOR}/centos/${LINUX_MAJOR}/x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm.rancher.io/public.key
EOF

Example for the testing channel:

export RKE2_MINOR=28
export LINUX_MAJOR=7 # or 8 or 9 etc
cat << EOF > /etc/yum.repos.d/rancher-rke2-1-${RKE2_MINOR}-latest.repo
[rancher-rke2-common-testing]
name=Rancher RKE2 Common Testing
baseurl=https://rpm-testing.rancher.io/rke2/testing/common/centos/${LINUX_MAJOR}/noarch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm-testing.rancher.io/public.key

[rancher-rke2-1-${RKE2_MINOR}-testing]
name=Rancher RKE2 1.${RKE2_MINOR} Testing
baseurl=https://rpm-testing.rancher.io/rke2/testing/1.${RKE2_MINOR}/centos/${LINUX_MAJOR}/x86_64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm-testing.rancher.io/public.key
EOF

[fmoral2]

OS

PRETTY_NAME="Red Hat Enterprise Linux 8.7 (Ootpa)"

Latest before updating receiving error as expected since only testing is available updated
https://github.com/rancher/rke2-packaging/tags

Rancher RKE2 Common Latest                                                                                                                                      39 kB/s | 2.4 kB     00:00    
Rancher RKE2 Common Latest                                                                                                                                     1.7 kB/s | 393  B     00:00    
Errors during downloading metadata for repository 'rancher-rke2-common-latest':
  - Status code: 404 for https://rpm.rancher.io/rke2/latest/common/centos/8/noarch/repodata/repomd.xml.asc (IP: 104.26.0.8)
Error: Failed to download metadata for repo 'rancher-rke2-common-latest': GPG verification is enabled, but GPG signature is not available. This may be an error or the repository does not support GPG verification: Status code: 404 for https://rpm.rancher.io/rke2/latest/common/centos/8/noarch/repodata/repomd.xml.asc (IP: 104.26.0.8)

Testing

Installed:
  container-selinux-2:2.229.0-2.module+el8.10.0+22417+2fb00970.noarch  iptables-1.8.5-11.el8_9.x86_64  iptables-libs-1.8.5-11.el8_9.x86_64         libibverbs-48.0-1.el8.x86_64    libnetfilter_conntrack-1.0.6-5.el8.x86_64   libnfnetlink-1.0.1-13.el8.x86_64 
  libnftnl-1.2.2-3.el8.x86_64                                          libpcap-14:1.9.1-5.el8.x86_64   rke2-common-1.32.3~rc1~rke2r1-1.el8.x86_64  rke2-selinux-0.19-4.el8.noarch  rke2-server-1.32.3~rc1~rke2r1-1.el8.x86_64 

Complete!
ec2-user@ip- ~$ sudo systemctl enable rke2-server --now
Created symlink /etc/systemd/system/multi-user.target.wants/rke2-server.service → /usr/lib/systemd/system/rke2-server.service.

$ kubectl get nodes,pods -A

NAME                                              STATUS   ROLES                       AGE     VERSION
node/ip- us-east-2.compute.internal   Ready    control-plane,etcd,master   2m32s   v1.32.3+rke2r1

NAMESPACE     NAME                                                                      READY   STATUS      RESTARTS   AGE
kube-system   pod/cloud-controller-manager-i .us-east-2.compute.internal   1/1     Running     0          2m10s
kube-system   pod/etcd-ip us-east-2.compute.internal                       1/1     Running     0          2m10s
kube-system   pod/helm-install-rke2-canal-28fpj                                         0/1     Completed   0          2m22s
kube-system   pod/helm-install-rke2-coredns-rv9q7                                       0/1     Completed   0          2m22s
kube-system   pod/helm-install-rke2-ingress-nginx-x74nn                                 0/1     Completed   0          2m22s
kube-system   pod/helm-install-rke2-metrics-server-v8k6j                                0/1     Completed   0          2m22s
kube-system   pod/helm-install-rke2-runtimeclasses-8kvjz                                0/1     Completed   0          2m22s
kube-system   pod/helm-install-rke2-snapshot-controller-crd-mh8qx                       0/1     Completed   0          2m22s
kube-system   pod/helm-install-rke2-snapshot-controller-tv8p2                           0/1     Completed   0          2m22s
kube-system   pod/kube-apiserver-ip- us-east-2.compute.internal             1/1     Running     0          2m10s
kube-system   pod/kube-controller-manager-i .us-east-2.compute.internal    1/1     Running     0          2m10s
kube-system   pod/kube-proxy-ip- us-east-2.compute.internal                 1/1     Running     0          2m10s
kube-system   pod/kube-scheduler-ip- .us-east-2.compute.internal             1/1     Running     0          2m10s
kube-system   pod/rke2-canal-4pbnx                                                      2/2     Running     0          2m3s
kube-system   pod/rke2-coredns-rke2-coredns-7769c87bd-2dnch                             1/1     Running     0          2m4s
kube-system   pod/rke2-coredns-rke2-coredns-autoscaler-5b9b76dbf6-zzmkg                 1/1     Running     0          2m4s
kube-system   pod/rke2-ingress-nginx-controller-9h45q                                   1/1     Running     0          77s
kube-system   pod/rke2-metrics-server-85479b695c-xlr9b                                  1/1     Running     0          88s
kube-system   pod/rke2-snapshot-controller-696989ffdd-5rg8x                             1/1     Running     0          89s

[fmoral2]

• dnf list --showduplicates rke2-server

showing the installed and availables

pdating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Last metadata expiration check: 0:19:48 ago on Mon 17 Mar 2025 04:38:30 PM UTC.
Installed Packages
rke2-server.x86_64                                                                                                 1.32.3~rc1~rke2r1-1.el8                                                                                                 @rancher-rke2-1-32-testing
Available Packages
rke2-server.x86_64                                                                                                 1.32.0~rc2~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.0~rc3~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.0~rke2r1-0.el8                                                                                                     rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.1~rc1~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.1~rc2~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.1~rc3~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.1~rke2r1-0.el8                                                                                                     rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.2~rc1~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.2~rc2~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.2~rc4~rke2r1-0.el8                                                                                                 rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.2~rke2r1-0.el8                                                                                                     rancher-rke2-1-32-testing 
rke2-server.x86_64                                                                                                 1.32.3~rc1~rke2r1-1.el8                                                                                                 rancher-rke2-1-32-testing 

[fmoral2]

• ARM machine with rhel 9

  bash -c " cat << EOF > /etc/yum.repos.d/rancher-rke2-testing.repo
[rancher-rke2-common-testing]
name=Rancher RKE2 Common Testing
baseurl=https://rpm-testing.rancher.io/rke2/testing/common/centos/9/noarch
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm-testing.rancher.io/public.key

[rancher-rke2-1.32-testing]
name=Rancher RKE2 1.32 Testing
baseurl=https://rpm-testing.rancher.io/rke2/testing/1.32/centos/9/aarch64
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm-testing.rancher.io/public.key
EOF"

 kubectl get nodes,pods -A
NAME                                               STATUS   ROLES                       AGE    VERSION
node/ip- us-east-2.compute.internal   Ready    control-plane,etcd,master   2m3s   v1.32.3+rke2r1

NAMESPACE     NAME                                                                       READY   STATUS      RESTARTS   AGE
kube-system   pod/cloud-controller-manager-ip- .us-east-2.compute.internal   1/1     Running     0          2m2s
kube-system   pod/etcd-ip- .us-east-2.compute.internal                       1/1     Running     0          2m3s
kube-system   pod/helm-install-rke2-canal-g4qzr                                          0/1     Completed   0          108s
kube-system   pod/helm-install-rke2-coredns-ghmm7                                        0/1     Completed   0          108s
kube-system   pod/helm-install-rke2-ingress-nginx-j4m48                                  0/1     Completed   0          108s
kube-system   pod/helm-install-rke2-metrics-server-x7zsm                                 0/1     Completed   0          108s
kube-system   pod/helm-install-rke2-runtimeclasses-fc8gf                                 0/1     Completed   0          107s
kube-system   pod/helm-install-rke2-snapshot-controller-crd-mjk9d                        0/1     Completed   0          107s
kube-system   pod/helm-install-rke2-snapshot-controller-vzp66                            0/1     Completed   2          107s
kube-system   pod/kube-apiserver-ip- .us-east-2.compute.internal             1/1     Running     0          2m3s
kube-system   pod/kube-controller-manager-ip-1 .us-east-2.compute.internal    1/1     Running     0          2m3s
kube-system   pod/kube-proxy-ip- .us-east-2.compute.internal                 1/1     Running     0          2m3s
kube-system   pod/kube-scheduler-ip- .us-east-2.compute.internal             1/1     Running     0          118s
kube-system   pod/rke2-canal-wzp94                                                       2/2     Running     0          103s
kube-system   pod/rke2-coredns-rke2-coredns-7769c87bd-jsrzc                              1/1     Running     0          103s
kube-system   pod/rke2-coredns-rke2-coredns-autoscaler-5b9b76dbf6-cpkht                  1/1     Running     0          103s
kube-system   pod/rke2-ingress-nginx-controller-4c5qs                                    1/1     Running     0          64s
kube-system   pod/rke2-metrics-server-85479b695c-hsjbb                                   1/1     Running     0          72s
kube-system   pod/rke2-snapshot-controller-696989ffdd-5lnmh                              1/1     Running     0          60s

[fmoral2]

• dnf list --showduplicates rke2-server

Last metadata expiration check: 0:07:11 ago on Tue 18 Mar 2025 01:13:51 PM UTC.
Installed Packages
rke2-server.aarch64                                                           1.32.3~rc1~rke2r1-1.el9                                                            @rancher-rke2-1.32-testing
Available Packages
rke2-server.aarch64                                                           1.32.2~rke2r1-0.el9                                                                rancher-rke2-1.32-testing 
rke2-server.aarch64                                                           1.32.3~rc1~rke2r1-1.el9                                                            rancher-rke2-1.32-testing 

[fmoral2]

• x86_64
• stable
• rhel 8

$ k get nodes,pods -A
NAME                                             STATUS   ROLES                       AGE   VERSION
node/ip- us-east-2.compute.internal   Ready    control-plane,etcd,master   96s   v1.32.3+rke2r1

NAMESPACE     NAME                                                                     READY   STATUS      RESTARTS   AGE
kube-system   pod/cloud-controller-manager- us-east-2.compute.internal   1/1     Running     0          84s
kube-system   pod/etcd-ip- us-east-2.compute.internal                       1/1     Running     0          84s
kube-system   pod/helm-install-rke2-canal-48l4w                                        0/1     Completed   0          87s
kube-system   pod/helm-install-rke2-coredns-kxqr7                                      0/1     Completed   0          87s
kube-system   pod/helm-install-rke2-ingress-nginx-n8wxd                                0/1     Completed   0          87s
kube-system   pod/helm-install-rke2-metrics-server-8bmhh                               0/1     Completed   0          87s
kube-system   pod/helm-install-rke2-runtimeclasses-v64wg                               0/1     Completed   0          87s
kube-system   pod/helm-install-rke2-snapshot-controller-6mncg                          0/1     Completed   0          87s
kube-system   pod/helm-install-rke2-snapshot-controller-crd-k5gvt                      0/1     Completed   0          87s
kube-system   pod/kube-apiserver-ip-1 .us-east-2.compute.internal             1/1     Running     0          84s
kube-system   pod/kube-controller-manager-ip-1 us-east-2.compute.internal    1/1     Running     0          84s
kube-system   pod/kube-proxy-ip- .us-east-2.compute.internal                 1/1     Running     0          84s
kube-system   pod/kube-scheduler-ip- .us-east-2.compute.internal             1/1     Running     0          84s
kube-system   pod/rke2-canal-d29xf                                                     2/2     Running     0          76s
kube-system   pod/rke2-coredns-rke2-coredns-7769c87bd-6q4b7                            0/1     Running     0          77s
kube-system   pod/rke2-coredns-rke2-coredns-autoscaler-5b9b76dbf6-zpmzv                1/1     Running     0          77s
kube-system   pod/rke2-ingress-nginx-controller-7x4rl                                  0/1     Running     0          24s
kube-system   pod/rke2-metrics-server-85479b695c-kgv27                                 1/1     Running     0          35s
kube-system   pod/rke2-snapshot-controller-696989ffdd-8j2wv                            1/1     Running     0          35s

• dnf list --showduplicates rke2-server

Last metadata expiration check: 0:06:55 ago on Thu 27 Mar 2025 03:03:01 PM UTC.
Installed Packages
rke2-server.x86_64                                                                  1.32.3~rke2r1-0.el8                                                                   @rancher-rke2-1.32-stable
Available Packages
rke2-server.x86_64                                                                  1.32.0~rke2r1-0.el8                                                                   rancher-rke2-1.32-stable 
rke2-server.x86_64                                                                  1.32.1~rke2r1-0.el8                                                                   rancher-rke2-1.32-stable 
rke2-server.x86_64                                                                  1.32.2~rke2r1-0.el8                                                                   rancher-rke2-1.32-stable 
rke2-server.x86_64                                                                  1.32.3~rke2r1-0.el8                                                                   rancher-rke2-1.32-stable