feature: airgap download additional tarballs

[Woudan]

Summary

The rke2_airgap_copy_additional_tarballs variable is present to copy local image tarballs to remote.

It would be nice if we can:

• Copy rke2_artifact to the offline image path. {{rke2_tarball_images_path}}. The rke2 scripting doesn't copy offline bundles for cillium etc.
• Download additional image tarballs from upstream.

For example for downloading additional image tarballs:

- name: Airgap mode - download additional images tarballs
  when:
    - rke2_airgap_mode
    - ( rke2_airgap_download_additional_tarballs | length > 0 )
    - rke2_airgap_implementation == 'download'
  block:
    - name: Create additional images tarballs folder
      ansible.builtin.file:
        path: "{{ rke2_tarball_images_path }}"
        state: directory
        mode: 0700
    - name: Download rke2 image tarball
      ansible.builtin.get_url:
        url: "{{ item }}"
        dest: "{{ rke2_tarball_images_path }}/{{ item | basename }}"
        mode: 0644
        force: yes
      with_items: "{{ rke2_airgap_download_additional_tarballs }}"

Issue Type

Feature Idea

[simonfelding]

It's pretty complex to implement and in my opinion it's out of scope for this project. I did it once and would not recommend the solution: You can solve this problem by getting the rke2_version (or current version from the selected channel), reading the git release api (json format), extracting the url to the images binaries you want, get them and place them in the path.

It sucks because it's hard to read, debug and maintain. Just get the version you want and put it in the folder. You could run a container registry in your airgapped cluster and point kubernetes to that registry. This simplifies the task a lot as you can just push your containers there instead and get them through normal mechanisms. The additional tarball path is only really for the absolute essentials you need to bootstrap the cluster. You could just bootstrap it with an older version of cilium and then update it through normal mechanisms once the cluster is up.

The internal registry solution is much better. If you like ansible a lot, you can just use https://docs.ansible.com/ansible/latest/collections/community/docker/docker_image_pull_module.html#ansible-collections-community-docker-docker-image-pull-module and https://docs.ansible.com/ansible/latest/collections/community/docker/docker_image_push_module.html to move your containers around.

[Woudan]

Hi @simonfelding, appreciate the feedback. I can imagine it's not something you want to add and maintain.

Adding it outside of the rke2 role is a bit of a hassle as the images are needed for a clean deployment. For getting the node in a "ready" state the cilium images are needed. No cilium images are provided in the default installer packages. I could pre-provision but rke2 role/install should manage the path and set correct permissions. As there already is copy logic I hoped this was something that could be added.

As this is the initial cluster we setup I would like to have it deployed fully offline. Going to figure out a different way by uploading it into a registry or to simplify it without cilium usage.

[simonfelding]

no no i'm not talking about pre-provisioning the nodes, just a playbook like this:

- name: Get prerequisites on localhost
  delegate_to: localhost
  run_once: true
  gather_facts: no
  tasks:
    - name: Get cilium tarball
      ansible.builtin.get_url:
        url: "https://github.com/rancher/rke2/releases/download/v1.31.3%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst"
        dest: "{{ rke2_tarball_images_path }}/"

- name: Setup RKE2
  hosts: k8s_cluster
  become: true
  gather_facts: true
  any_errors_fatal: true
  roles:
    - role: rke2

then you can handle all your logic regarding what version you want to get etc as you please.

You can also just add the cilium image to the rke2_artifact variable like so? There is already logic that handles downloading it locally and pushing it when you use airgap_mode=download

rke2_artifact:
  - sha256sum-{{ rke2_architecture }}.txt
  - rke2.linux-{{ rke2_architecture }}.tar.gz
  - rke2-images.linux-{{ rke2_architecture }}.tar.zst
  - rke2-images-cilium.linux-{{ rke2_architecture  }}.tar.zst

[Woudan]

Hi Simon, yes above should work but we have the dependency that the folder "rke2_tarball_images_path" should already exist which is normally created by rke2 role.

I've tried adding it like you show in the rke2_artifact variable also expecting this should work but rke2 doesn't copy the additional artifacts to the offline images rke2 folder. RKE2 installer only copies the standard images "rke2-images.linux-". Additional image bundles need to be copied outside of rke2 installer.