RKE2 cluster (host-level)

v0.2.3

RKE2-specific host introspection that kubectl can't give you — embedded-etcd live health (etcdctl endpoint health/status) and snapshot history, node certificate expiry, and the RKE2-bundled containerd via crictl (containers, pods, images). Runs on an RKE2 server node. Generic Kubernetes API reads are in the kubernetes pack; rke2-server / rke2-agent unit status and logs are covered by the linux-core / systemd-deep packs (systemctl status rke2-server, journalctl -u rke2-server).

6 allowed by default

Pack ID

rke2

Vendor

emisar

linux

Actions

Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.


              rke2

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host

sudo emisar pack install rke2 --hash sha256:3387d266fcc2f072d80fe6cea64e75076e396d691ee47a5859eb8eb510e8be87

Setup

Runs on an RKE2 server node, as root (etcd-snapshot, certificate check, and crictl — including the etcd_health crictl exec — all need root). rke2 reads /etc/rancher/rke2/config.yaml by default; crictl talks to the RKE2 containerd socket via CRI_CONFIG_FILE.

Host access

Run these commands yourself on the runner host. Emisar shows and copies setup recipes; it never runs them.

Read RKE2 server credentials, containerd, and embedded etcd state as root.

rke2.etcd_healthrke2.etcd_snapshot_listrke2.certificate_checkrke2.crictl_psrke2.crictl_podsrke2.crictl_images

Run the Emisar service as root

Grant access

sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-rke2-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar

Verify access

test "$(systemctl show emisar --property=User --value)" = root

Impact: Every Emisar action on this runner executes as root. These actions can read the RKE2 server's client keys and control its container runtime despite being read-only.

Notes

Binary-path exception: RKE2 does not add /var/lib/rancher/rke2/bin to PATH, so crictl is invoked by its absolute path inside a /bin/sh command (the same absolute-path-in-a-shell-pipeline pattern other read actions use). rke2 itself installs to /usr/local/bin and is invoked bare.
On an agent-only node there is no etcd and no rke2 server cert set, so etcd_health / etcd_snapshot_list / certificate_check will not return server data.
etcd_health: RKE2 ships no etcdctl on the host PATH, so the action runs the etcdctl already inside the running etcd static-pod container (resolved via crictl), authenticating to https://127.0.0.1:2379 with this node's own etcd CA + server-client cert under /var/lib/rancher/rke2/server/tls/etcd/. Cert filenames verified against a live RKE2 v1.35.x server (server-ca.crt + server-client.crt/.key) and the kube-apiserver's own --etcd-* flags. Pair with etcd_snapshot_list (backups current?) and kubernetes.control_plane_health (/readyz).

Verify it works

Runs rke2.certificate_check, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host

sudo emisar pack verify rke2

Install and configure a pack walks through the whole sequence on a host.

Actions 6 total

View on GitHub

rke2.certificate_check exec low

Check RKE2 certificate expiry (rke2 certificate check)

Show per-certificate subject, status, and expiry date for this node's RKE2 certs. RKE2 leaf certs default to 365 days and auto-renew on restart within 90 days of expiry; this surfaces a node whose certs are about to lapse. Read-only.
View source on GitHub
rke2.crictl_images exec low

List images on this node (crictl images)

List the container images present in this node's RKE2 containerd — repository, tag, image id, and size. Use to confirm an image is actually pulled on a node (ImagePullBackOff triage) or to see disk pressure from images. Read-only.
View source on GitHub
rke2.crictl_pods exec low

List pod sandboxes on this node (crictl pods)

List pod sandboxes on this node's RKE2 containerd — pod id, name, namespace, state, age. The CRI view of which pods the node actually has, independent of the API server. Read-only.
View source on GitHub
rke2.crictl_ps exec low

List containers on this node (crictl ps -a)

List all containers (running and stopped) on this node's RKE2 containerd — container id, image, state, name, attempt count, and pod. The CRI-level truth when kubelet/kubectl disagree about what's running on a node, and where you see crash/restart loops. Read-only.
View source on GitHub
rke2.etcd_health exec low

Check embedded etcd health (etcdctl endpoint health + status)

Check the embedded etcd's live health and status on this RKE2 server node — `etcdctl endpoint health` (is the member committing proposals?) followed by `endpoint status` (etcd version, DB size, leader, raft term/index). The direct read of etcd that snapshot-list and /readyz only approximate. RKE2 ships no etcdctl on the host PATH, so this runs the etcdctl already inside the running etcd static-pod container (found via crictl), authenticating to the local client endpoint (https://127.0.0.1:2379) with RKE2's own etcd server CA and the etcd server-client cert. Read-only; exits non-zero if etcd is unhealthy.
View source on GitHub
rke2.etcd_snapshot_list exec low

List etcd snapshots (rke2 etcd-snapshot ls)

List the embedded-etcd snapshots RKE2 has taken — name, location (local / S3), size, and creation time. Confirms backups are current; an empty or stale list is an etcd-recovery risk. Read-only.
View source on GitHub

← Back to registry

Pack reference Publish your own