dgiebert

# Check https://docs.rke2.io/install/requirements#inbound-network-rules
# Enable the Host Firewall feature: https://docs.cilium.io/en/latest/security/host-firewall/
# HelmChartConfig Example:
# apiVersion: helm.cattle.io/v1
# kind: HelmChartConfig
# metadata:
#   name: rke2-cilium
#   namespace: kube-system
# spec:
#   valuesContent: |-

dgiebert

Prepare the Cluster

Deploy this config to all clusters that you want to form a mesh with

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-cilium
  namespace: kube-system
spec:
  valuesContent: |-

dgiebert

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-ingress-nginx
  namespace: kube-system
spec:
  valuesContent: |-
    controller:
      hostPort:
        enabled: false

dgiebert

Debugging etcd performance issues

fio

curl -LO https://github.com/rancherlabs/support-tools/raw/master/instant-fio-master/instant-fio-master.sh
zypper in zlib-devel make git gcc
bash instant-fio-master.sh
mkdir test-data
fio --rw=write --ioengine=sync --fdatasync=1 --directory=test-data --size=100m --bs=2300 --name=mytest

dgiebert

---
apiVersion: v1
kind: Secret
metadata:
  name: gvisor
  namespace: cattle-system
type: Opaque
stringData:
  gvisor: "20240206"
  upgrade.sh: |

dgiebert

FROM registry.suse.com/rancher/elemental-teal/5.4:1.2.3 AS build

RUN zypper --non-interactive rm --clean-deps \
        bash-completion jq k9s podman vim-small \
        kernel-firmware*
    
# IMPORTANT: /etc/os-release is used for versioning/upgrade. The
# values here should reflect the tag of the image currently being built
ARG IMAGE_REPO=norepo
ARG IMAGE_TAG=latest

dgiebert

Install the Official Cilium Chart on RKE2

1. Create a file /etc/rancher/rke2/config.yaml

   cni: none
   disable:
   - rke2-ingress-nginx

2. Apply the following manifest

   apiVersion: helm.cattle.io/v1

dgiebert

module selinux-policy-iptables 1.0;
 
require {
    type cgroup_t;
    type iptables_t;
    class dir ioctl;
}
 
#============= iptables_t ==============
allow iptables_t cgroup_t:dir ioctl;

dgiebert

#cloud-config
# Tested with SL Micro 6.0 and OpenSUSE Leap Micro 6.0
### System
locale: en_US.UTF-8
timezone: Europe/Berlin
### Users
user: suse
ssh_authorized_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOY5nEt0qssNTouZzN4LPg8M3OyDAwGDDvreTUMA6hQ5
users:

dgiebert

#cloud-config
user: sles
package_update: true
package_upgrade: true
package_reboot_if_required: true
bootcmd:
- '[ -f /usr/bin/SUSEConnect ] && SUSEConnect -r <ActivationCode> -e <EmailAddress>'
packages:
- htop
- ncdu