validateScheduledClusterScan panic seen when creating/applying changes to cluster from RKE template with CIS scan enabled #26616
Comments
|
Per #26845 Steps to reproduce:
Current cluster template (v1) (as shown in Global > Tools > RKE Templates): #
# Cluster Config
#
default_pod_security_policy_template_id: unrestricted
docker_root_dir: /var/lib/docker
enable_cluster_alerting: false
enable_cluster_monitoring: false
enable_network_policy: false
local_cluster_auth_endpoint:
enabled: true
#
# Rancher Config
#
rancher_kubernetes_engine_config:
addon_job_timeout: 30
authentication:
strategy: x509|webhook
bastion_host:
ssh_agent_auth: false
dns:
nodelocal:
ip_address: ''
ignore_docker_version: true
#
# # Currently only nginx ingress provider is supported.
# # To disable ingress controller, set `provider: none`
# # To enable ingress on specific nodes, use the node_selector, eg:
# provider: nginx
# node_selector:
# app: ingress
#
ingress:
provider: nginx
kubernetes_version: v1.17.4-rancher1-3
monitoring:
provider: metrics-server
replicas: 1
#
# If you are using calico on AWS
#
# network:
# plugin: calico
# calico_network_provider:
# cloud_provider: aws
#
# # To specify flannel interface
#
# network:
# plugin: flannel
# flannel_network_provider:
# iface: eth1
#
# # To specify flannel interface for canal plugin
#
# network:
# plugin: canal
# canal_network_provider:
# iface: eth1
#
network:
mtu: 0
options:
flannel_backend_type: vxlan
plugin: canal
nodes:
- address: 10.0.40.43
hostname_override: t620-4
node_id: 'c-7r82m:m-887bd52ecde7'
port: '22'
role:
- worker
ssh_agent_auth: false
user: root
- address: 10.0.40.40
hostname_override: t620-1
node_id: 'c-7r82m:m-923e9db9577a'
port: '22'
role:
- etcd
- controlplane
- worker
ssh_agent_auth: false
user: root
- address: 10.0.40.42
hostname_override: t620-3
node_id: 'c-7r82m:m-9cabfe43cf2a'
port: '22'
role:
- etcd
- controlplane
- worker
ssh_agent_auth: false
user: root
- address: 10.0.40.41
hostname_override: t620-2
node_id: 'c-7r82m:m-b83494e356ee'
port: '22'
role:
- etcd
- controlplane
- worker
ssh_agent_auth: false
user: root
restore:
restore: false
#
# services:
# kube-api:
# service_cluster_ip_range: 10.43.0.0/16
# kube-controller:
# cluster_cidr: 10.42.0.0/16
# service_cluster_ip_range: 10.43.0.0/16
# kubelet:
# cluster_domain: cluster.local
# cluster_dns_server: 10.43.0.10
#
services:
etcd:
backup_config:
enabled: true
interval_hours: 6
retention: 40
s3_backup_config:
access_key: <REMOVED>
bucket_name: <REMOVED>
endpoint: nyc3.digitaloceanspaces.com
safe_timestamp: false
creation: 12h
extra_args:
election-timeout: '5000'
heartbeat-interval: '500'
gid: 0
retention: 72h
snapshot: false
uid: 0
kube_api:
always_pull_images: false
pod_security_policy: true
service_node_port_range: 30000-32767
kubelet:
fail_swap_on: false
generate_serving_certificate: false
ssh_agent_auth: false
upgrade_strategy:
drain: false
max_unavailable_controlplane: '1'
max_unavailable_worker: 10%
node_drain_input:
delete_local_data: 'false'
force: false
grace_period: -1
ignore_daemon_sets: true
timeout: 120
scheduled_cluster_scan:
enabled: true
scan_config:
cis_scan_config:
debug_master: false
debug_worker: false
override_benchmark_version: rke-cis-1.4
profile: permissive
schedule_config:
cron_schedule: 0 0 * * *
retention: 40
windows_prefered_cluster: falseUpdated RKE Template (v2) (As shown in Global > Tools > RKE Templates): #
# Cluster Config
#
default_pod_security_policy_template_id: unrestricted
docker_root_dir: /var/lib/docker
enable_cluster_alerting: false
enable_cluster_monitoring: false
enable_network_policy: false
local_cluster_auth_endpoint:
enabled: true
#
# Rancher Config
#
rancher_kubernetes_engine_config:
addon_job_timeout: 30
authentication:
strategy: x509|webhook
bastion_host:
ssh_agent_auth: false
dns:
nodelocal:
ip_address: ''
ignore_docker_version: true
#
# # Currently only nginx ingress provider is supported.
# # To disable ingress controller, set `provider: none`
# # To enable ingress on specific nodes, use the node_selector, eg:
# provider: nginx
# node_selector:
# app: ingress
#
ingress:
provider: nginx
kubernetes_version: v1.17.4-rancher1-3
monitoring:
provider: metrics-server
replicas: 1
#
# If you are using calico on AWS
#
# network:
# plugin: calico
# calico_network_provider:
# cloud_provider: aws
#
# # To specify flannel interface
#
# network:
# plugin: flannel
# flannel_network_provider:
# iface: eth1
#
# # To specify flannel interface for canal plugin
#
# network:
# plugin: canal
# canal_network_provider:
# iface: eth1
#
network:
mtu: 0
options:
flannel_backend_type: vxlan
plugin: canal
nodes:
- address: 10.0.40.43
hostname_override: t620-4
node_id: 'c-7r82m:m-887bd52ecde7'
port: '22'
role:
- worker
ssh_agent_auth: false
user: root
- address: 10.0.40.40
hostname_override: t620-1
node_id: 'c-7r82m:m-923e9db9577a'
port: '22'
role:
- etcd
- controlplane
- worker
ssh_agent_auth: false
user: root
- address: 10.0.40.42
hostname_override: t620-3
node_id: 'c-7r82m:m-9cabfe43cf2a'
port: '22'
role:
- etcd
- controlplane
- worker
ssh_agent_auth: false
user: root
- address: 10.0.40.41
hostname_override: t620-2
node_id: 'c-7r82m:m-b83494e356ee'
port: '22'
role:
- etcd
- controlplane
- worker
ssh_agent_auth: false
user: root
restore:
restore: false
#
# services:
# kube-api:
# service_cluster_ip_range: 10.43.0.0/16
# kube-controller:
# cluster_cidr: 10.42.0.0/16
# service_cluster_ip_range: 10.43.0.0/16
# kubelet:
# cluster_domain: cluster.local
# cluster_dns_server: 10.43.0.10
#
services:
etcd:
backup_config:
enabled: true
interval_hours: 6
retention: 40
s3_backup_config:
access_key: <REMOVED>
bucket_name: <REMOVED>
endpoint: nyc3.digitaloceanspaces.com
folder: <REMOVED>
safe_timestamp: false
creation: 12h
extra_args:
election-timeout: '5000'
heartbeat-interval: '500'
gid: 0
retention: 72h
snapshot: false
uid: 0
kube_api:
always_pull_images: false
pod_security_policy: true
service_node_port_range: 30000-32767
kubelet:
fail_swap_on: false
generate_serving_certificate: false
ssh_agent_auth: false
upgrade_strategy:
drain: false
max_unavailable_controlplane: '1'
max_unavailable_worker: 10%
node_drain_input:
delete_local_data: 'false'
force: false
grace_period: -1
ignore_daemon_sets: true
timeout: 120
scheduled_cluster_scan:
enabled: true
scan_config:
cis_scan_config:
debug_master: false
debug_worker: false
override_benchmark_version: rke-cis-1.4
profile: permissive
schedule_config:
cron_schedule: 0 0 * * *
retention: 40
windows_prefered_cluster: false |
|
Was the cluster created in v2.4.2 or in an earlier version? How was the cluster created (manual/automated), with what config? Were only the three toggles changed on revision clone? |
|
Cluster was created within the last three days using the latest version. Created using the Custom option for hosts with automated deployment with Rancher (running the join command on each node). I’m not sure what you mean by config, the v1 RKE template is from the original deployment. Only those 3 toggles were changed. |
|
Based on current findings, this seems to happen when creating a cluster from an RKE template that has CIS scan enabled. |
|
Just to clarify, I created the RKE V1 template after installing the cluster, this error only occurred when trying to update the template for the cluster. |
|
Hit the issue on
|
|
[2.4] Do not validate CIS on cluster from template #26890 |
On a fresh install of 2.4.3-rc5
Upgrade from 2.3.2 to 2.4.3-rc5
Fresh install of master-head - commit id:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What kind of request is this (question/bug/enhancement/feature request):
Bug
Steps to reproduce (least amount of steps as possible):
e.g.
Result:
Other details that may be helpful:
Environment information
rancher/rancher/rancher/serverimage tag or shown bottom left in the UI): v2.4.2Cluster information
kubectl version):docker version): 18.09.2The text was updated successfully, but these errors were encountered: