bgulla

k3s/RKE2 with external CRI/containerd support

While k3s and RKE2 ship with their own statically-compiled containerd binary, sometimes you need to be able to utilize a more standard container socket. Especially if your container-scanner expects a more traditional installation path (i.e. Twistlock/PrismaCloud). This quick guide will show you how to get up and running with an external CRI.

Install containerd

There are better ways to do this, but the most common way of installing containerd is via the docker-ce yum repository.

sudo yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo

bgulla

bgulla

On-Prem RKE2 api-server HA with Kube-VIP

               ,        ,  _______________________________
   ,-----------|'------'|  |                             |
  /.           '-'    |-'  |_____________________________|
 |/|             |    |    
   |   .________.'----'    _______________________________
   |  ||        |  ||      |                             |
   \__|'        \__|'      |_____________________________|

bgulla

WIP

bgulla

#  _                   _     _
# | | _____      _____(_) __| | ___
# | |/ _ \ \ /\ / / __| |/ _` |/ _ \
# | | (_) \ V  V /\__ \ | (_| |  __/
# |_|\___/ \_/\_/ |___/_|\__,_|\___|
#

# download images
wget https://github.com/rancher/rke2/releases/download/v1.18.13%2Brke2r1/rke2-images.linux-amd64.tar.gz

bgulla

apiVersion: v1
kind: Service
metadata:
  name: rancher-svc
  namespace: kube-system
spec:
  type: LoadBalancer
  ports:
  - port: 443
    protocol: TCP

bgulla

#!/bin/bash

# create the cattle-system namespace
kubectl create ns cattle-system

# Setup the certificate-authority
cp ./certs/ca.crt /tmp/cacerts.pem
kubectl -n cattle-system create secret generic tls-ca \
  --from-file=cacerts.pem=/tmp/cacerts.pem

bgulla

{
  "banner": {
    "textColor": "#FFFFFF",
    "background": "#368024",
    "text": "UNCLASSIFIED Rancher Federal Demo Environment UNCLASSIFIED"
  },
  "showHeader": "true",
  "showFooter": "true"
}

bgulla

---
apiVersion: v1
kind: Namespace
metadata:
  name: demo

---
apiVersion: apps/v1
kind: Deployment
metadata:

bgulla

*.tplinkra.com
*.tplinkcloud.com