[Release-1.28] - Network Policy rke2-flannel-host-networking when cis-1.23 and calico

[brandond]

Backport fix for Network Policy rke2-flannel-host-networking when cis-1.23 and calico

• Network Policy rke2-flannel-host-networking when cis-1.23 and calico #5315

[ShylajaDevadiga]

Validated using rke2 version v1.28.7-rc2+rke2r1

Environment Details

Infrastructure
Cloud EC2 instance

Node(s) CPU architecture, OS, and Version:

cat /etc/os-release 
NAME="SLES"
VERSION="15-SP4"
VERSION_ID="15.4"
PRETTY_NAME="SUSE Linux Enterprise Server 15 SP4"
ID="sles"
ID_LIKE="suse"

Cluster Configuration:
Multi node, 3 server 1 agent

Config.yaml:

write-kubeconfig-mode: "0644"
tls-san:
  - fake.fqdn.value
node-name: ip-172-31-12-13.us-east-2.compute.internal
profile: cis-1.23
cni: calico

Steps to reproduce

1. Copy config.yaml
2. Install rke2
3. Check for existence of policy on a new cluster
4. Confirm ingress works as expected

Validation results:
Network Policy rke2-flannel-host-networking does not exist when cni: calico is used

ec2-user@ip-172-31-12-13:~> kubectl get netpol -A |grep flannel
ec2-user@ip-172-31-12-13:~>

ec2-user@ip-172-31-12-13:~> kubectl apply -f ing
namespace/test-ingress created
networkpolicy.networking.k8s.io/ingress-to-backends created
ingress.networking.k8s.io/test-ingress created
service/nginx-ingress-svc created
replicationcontroller/test-ingress created
networkpolicy.networking.k8s.io/allow-all-ingress created

Network Policy rke2-flannel-host-networking exists when cni: canal (default cni) is used

ec2-user@ip-172-31-11-46:~> cat /etc/rancher/rke2/config.yaml
write-kubeconfig-mode: "0644"
tls-san:
  - fake.fqdn.value
node-name: ip-172-31-11-46.us-east-2.compute.internal
profile: cis-1.23

ec2-user@ip-172-31-11-46:~> kubectl get networkpolicy -A |grep flannel
default       rke2-flannel-host-networking             <none>                                      21h
kube-public   rke2-flannel-host-networking             <none>                                      21h
kube-system   rke2-flannel-host-networking             <none>                                      21h

Network Policy rke2-flannel-host-networking does not exist when cni: cilium is used

ec2-user@ip-172-31-10-150:~> cat /etc/rancher/rke2/config.yaml
write-kubeconfig-mode: "0644"
tls-san:
  - fake.fqdn.value
node-name: ip-172-31-10-150.us-east-2.compute.internal
profile: cis-1.23
cni: cilium

ec2-user@ip-172-31-10-150:~> kubectl get networkpolicy -A|grep flannel
ec2-user@ip-172-31-10-150:~>

ec2-user@ip-172-31-10-150:~> kubectl apply -f ing
namespace/test-ingress created
networkpolicy.networking.k8s.io/ingress-to-backends created
ingress.networking.k8s.io/test-ingress created
service/nginx-ingress-svc created
replicationcontroller/test-ingress created
networkpolicy.networking.k8s.io/allow-all-ingress created