Skip to main content
emisar

RKE2 cluster (host-level)

v0.2.2

RKE2-specific host introspection that kubectl can't give you — embedded-etcd live health (etcdctl endpoint health/status) and snapshot history, node certificate expiry, and the RKE2-bundled containerd via crictl (containers, pods, images). Runs on an RKE2 server node. Generic Kubernetes API reads are in the kubernetes pack; rke2-server / rke2-agent unit status and logs are covered by the linux-core / systemd-deep packs (systemctl status rke2-server, journalctl -u rke2-server).

6 allowed by default
Pack ID
rke2
Vendor
emisar
OS
linux
Actions
6
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
rke2

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install rke2 --hash sha256:05d0c67184f9fe379307b53eecd62dc0211bd3fc4f05a9cd36bc1e46166007b4

Setup

Runs on an RKE2 server node, as root (etcd-snapshot, certificate check, and crictl — including the etcd_health crictl exec — all need root). rke2 reads /etc/rancher/rke2/config.yaml by default; crictl talks to the RKE2 containerd socket via CRI_CONFIG_FILE.

Notes

  • Binary-path exception: RKE2 does not add /var/lib/rancher/rke2/bin to PATH, so crictl is invoked by its absolute path inside a /bin/sh command (the same absolute-path-in-a-shell-pipeline pattern other read actions use). rke2 itself installs to /usr/local/bin and is invoked bare.
  • Run the runner as root (or grant it the equivalent) on the server node — every action needs it. On an agent-only node there is no etcd and no rke2 server cert set, so etcd_health / etcd_snapshot_list / certificate_check will not return server data.
  • etcd_health: RKE2 ships no etcdctl on the host PATH, so the action runs the etcdctl already inside the running etcd static-pod container (resolved via crictl), authenticating to https://127.0.0.1:2379 with this node's own etcd CA + server-client cert under /var/lib/rancher/rke2/server/tls/etcd/. Cert filenames verified against a live RKE2 v1.35.x server (server-ca.crt + server-client.crt/.key) and the kube-apiserver's own --etcd-* flags. Pair with etcd_snapshot_list (backups current?) and kubernetes.control_plane_health (/readyz).

Verify it works

Runs rke2.certificate_check, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify rke2

Install and configure a pack walks through the whole sequence on a host.

Actions 6 total

View on GitHub
  • rke2.certificate_check exec low Low — read-only or trivially reversible

    Check RKE2 certificate expiry (rke2 certificate check)

    Show per-certificate subject, status, and expiry date for this node's RKE2 certs. RKE2 leaf certs default to 365 days and auto-renew on restart within 90 days of expiry; this surfaces a node whose certs are about to lapse. Read-only.

    View source on GitHub
  • rke2.crictl_images exec low Low — read-only or trivially reversible

    List images on this node (crictl images)

    List the container images present in this node's RKE2 containerd — repository, tag, image id, and size. Use to confirm an image is actually pulled on a node (ImagePullBackOff triage) or to see disk pressure from images. Read-only.

    View source on GitHub
  • rke2.crictl_pods exec low Low — read-only or trivially reversible

    List pod sandboxes on this node (crictl pods)

    List pod sandboxes on this node's RKE2 containerd — pod id, name, namespace, state, age. The CRI view of which pods the node actually has, independent of the API server. Read-only.

    View source on GitHub
  • rke2.crictl_ps exec low Low — read-only or trivially reversible

    List containers on this node (crictl ps -a)

    List all containers (running and stopped) on this node's RKE2 containerd — container id, image, state, name, attempt count, and pod. The CRI-level truth when kubelet/kubectl disagree about what's running on a node, and where you see crash/restart loops. Read-only.

    View source on GitHub
  • rke2.etcd_health exec low Low — read-only or trivially reversible

    Check embedded etcd health (etcdctl endpoint health + status)

    Check the embedded etcd's live health and status on this RKE2 server node — `etcdctl endpoint health` (is the member committing proposals?) followed by `endpoint status` (etcd version, DB size, leader, raft term/index). The direct read of etcd that snapshot-list and /readyz only approximate. RKE2 ships no etcdctl on the host PATH, so this runs the etcdctl already inside the running etcd static-pod container (found via crictl), authenticating to the local client endpoint (https://127.0.0.1:2379) with RKE2's own etcd server CA and the etcd server-client cert. Read-only; exits non-zero if etcd is unhealthy.

    View source on GitHub
  • rke2.etcd_snapshot_list exec low Low — read-only or trivially reversible

    List etcd snapshots (rke2 etcd-snapshot ls)

    List the embedded-etcd snapshots RKE2 has taken — name, location (local / S3), size, and creation time. Confirms backups are current; an empty or stale list is an etcd-recovery risk. Read-only.

    View source on GitHub
← Back to registry
Pack reference  Publish your own