In each release, it is very common to update the charts that rke2 is using. This document describes the process that mus
t be followed to succeed in updating and integrating it into rke2 and Rancher.
## What are these rke2-charts?
The following RKE2 components are consumed using Helm Charts:
- coredns
- ingress-nginx
- metrics-server
- kube-proxy (up to v1.21)
- all cni plugins
The charts of these components are in the [rke2-charts repo](https://github.com/rancher/rke2-charts/tree/main-source/packages)
and are installed in the cluster by the [helm-controller](https://github.com/k3s-io/helm-controller), which is one of
the controllers part of `rke2 server` binary.
## How to update a chart?
Before going into updating the chart, note a chart update normally means updating the images that this chart is consumin
g. In general, rke2 is consuming hardened images that are built using a FIPS compliant process. In other words, **do not
use the upstream images**. Instead, refer to the Github project building that image and use the code of the upstream
project to yield a hardened image. The Github projects building hardened images are under our [github rancher](https://github.com/rancher/)
and start with the name `image-build-`, for example: [image-build-coredns](https://github.com/rancher/image-build-coredns).
There are two exceptions to this rule: Calico and Cilium. For these components, we are mirroring the upstream images
into our rancher dockerhub and consuming those. To mirror new images, refer to [the README of the image-mirror repo](https://github.com/rancher/image-mirror/blob/master/README.md).
To apply changes to a chart, please follow the [README](https://github.com/rancher/rke2-charts/blob/main-source/README.md)
of the rke2-charts project. Once the PR has been merged, move to the `main` branch in the rke2-charts project and check
your chart under the directory `assets/`. A new tarball would be there with your changes with a name that follows the
pattern `$chartName-$version.tgz`. For example: `rke2-calico-v3.19.2-201.tgz`.
## My chart is ready, how to integrate it into rke2 and Rancher?
From the previous section, you know the name of the chart (e.g. `rke2-calico`) and its version (e.g. `v3.19.2-201`).
Using that information, we can easily update rke2 and Rancher following the next steps:
1. Open [Dockerfile](https://github.com/rancher/rke2/blob/master/Dockerfile) and go to the stage where the charts are
build (`FROM build AS charts`). There, modify the line where we are referring to the chart, e.g. for calico:
```
RUN CHART_VERSION="v3.19.1-105" CHART_FILE=/charts/rke2-calico.yaml CHART_BOOTSTRAP=true /charts/build-chart.sh
```
If we want the new version to be consumed, we should update the value of `RUN CHART_VERSION`:
```
RUN CHART_VERSION="v3.19.2-201" CHART_FILE=/charts/rke2-calico.yaml CHART_BOOTSTRAP=true /charts/build-chart.sh
```
2. For CNI plugins only, we need to do the same for [Dockerfile.windows](https://github.com/rancher/rke2/blob/master/Dockerfile.windows).
In this case, we are not using helm and we are downloading a released tarball from the upstream project. Therefore, we
must use the version that makes sense for the upstream project, and not the previous version which was pointing to the
rke2-charts tarball. The version in the Dockerfile is tracked by a variable, which for example for Calico is
`CALICO_VERSION`. If we move from v3.19.1 to v3.19.2, we should open the file and change:
```
ENV CALICO_VERSION="v3.19.2"
```
3. If the update of the chart means using different images, we must update the script for air-gap scenarios. Open the
file [scripts/build-images](https://github.com/rancher/rke2/blob/master/scripts/build-images) and update the version of
the images. Images used by CNI plugins have their own section, for example for Calico:
Manuel Buil <mbuil@suse.com>