[QUESTION] How to configure rke2 when using cilium installed separately not as rke2 addon

[riuvshyn]

Hello, do I need to keep cni: cilium and disable: rke2-cilium to prevent rke2 installing cilium when I am using cilium installed separately from rke2?
I am just not sure if cni: cilium only responsible for installing rke2-cilium helm chart or it is also doing something else, so it still have to be set when cilium is used as CNI

Cheers 🍻

[brandond]

If you're planning on deploying Cilium standalone, I would probably create the cluster with cni: none from the start. I'm not sure what the impact is of deploying the cluster with rke2-cilium, installing standalone cilium, and then disabling rke2-cilium. That's not something we've tested.

[riuvshyn]

Thanks! cni: cilium is only supposed to install cilium chart?

Reason why I am asking this is that I want to be able to control cilium version for example I can't upgrade cilium to 1.16.x but I absolutely must upgrade k8s to 1.29.x due to EOL of 1.28.x

What I did so far is I have moved cilium HelmChart resource to additional-manifests and disabled rke2-cilium. I am using exactly same chart that was installed by rke2.

But now I am not sure if I should keep cni: cilium or change it to cni: none, so I am trying to understand what exacrtly cni: flag does

[brandond]

The cni option selects which of the CNI charts are enabled; the other ones are all disabled. Setting cni: none is the same as setting disable: [rke2-cilium].

Am I correct in understanding that you're trying to upgrade RKE2 without upgrading Cilium as well? Why?

[riuvshyn]

The cni option selects which of the CNI charts are enabled; the other ones are all disabled. Setting cni: none is the same as setting disable: [rke2-cilium].

cool, thanks! that is what I wanted to clarify.

Am I correct in understanding that you're trying to upgrade RKE2 without upgrading Cilium as well? Why?

There are multiple reasons for this:

• I want to control life cycle of cluster critical infrastructure components independently
• I don't want to upgrade cilium and k8s in the same time

For example there is a bug in cilium 1.16 cilium/cilium#35080 which is critical for my workloads so I don't want to upgrade cilium right now before it is fixed but also I can't hold k8s upgrade anymore due to EOL.

[brandond]

You're welcome to do that, but note that we don't test or support any CNI versions other than what is shipped with a given release of RKE2.

[riuvshyn]

Yeah I totally understand that that is why I am also using rancher patched chart instead of upstream one and will only select versions mentioned in rke2 releases as they are tested.