antony@notes:~/rancher$ cat "How-to-update-rke2-to-cis-profile.md"
How to update rke2 to cis profile
How to update rke2 to cis profile
以下命令要先在 update 之前執行
Control-plane node 跑
sudo cp -vf /usr/local/share/rke2/rke2-cis-sysctl.conf /etc/sysctl.d/60-rke2-cis.conf && \
sudo systemctl restart systemd-sysctl && \
sudo useradd -r -c "etcd user" -s /sbin/nologin -M etcd -U; \
sudo reboot如果先更新下去會在 rke2-server 的 service 看到以下錯誤訊息
missing required: user: unknown user etcd\nmissing required: group: unknown group etcd\n
worker node 跑 (如果是透過 Rancher 去更新，以下指令不用做)
cp /opt/rke2/share/rke2/rke2-cis-sysctl.conf /etc/sysctl.d/60-rke2-cis.conf && \
systemctl restart systemd-sysctl
reboot