airgap_harvester_vcluster.md

Air Gapping Vcluster from Loft.sh

This idea is from using vcluster to serve our Rancher on Harvester : https://docs.harvesterhci.io/v1.4/advanced/addons/rancher-vcluster/ and https://www.vcluster.com/docs/platform/install/advanced/air-gapped.

There are quite a few moving parts here. In addtion to Vcluster assets we need to grab Rancher's as well. Rancher adds Cert-Manager.
Here is the install yaml https://github.com/harvester/experimental-addons/blob/main/rancher-vcluster/rancher-vcluster.yaml

Parts

• vcluster
• certmanager
• rancher

Major Steps

Hauler - https://ranchergovernment.com/products/hauler

• Get images, helm charts, and yaml
• Move all the bits across the air gap
• Serve out bits

Configure Harvester

This might get a bit tricky to tell Harvester to use an external registry, aka hauler, to pull the images/charts. Another possible solution is to update the vlcuster install yaml to point specifically to hauler.

• Install vcluster with modified yaml
  • https://github.com/harvester/experimental-addons/blob/main/rancher-vcluster/rancher-vcluster.yaml

Bonus

Harvester v1.4.1 uses k8s v1.30.7. So the k3s piece is v1.30.7-k3s1.

vcluster_hauler.yaml

---
apiVersion: content.hauler.cattle.io/v1alpha1
kind: Images
metadata:
  name: rancher-images
  annotations:
    hauler.dev/platform: linux/amd64
spec:
  images:
    - name: ghcr.io/loft-sh/vcluster-platform:4.3.0-alpha.0
    - name: ghcr.io/loft-sh/devpod-pro:4.3.0-alpha.0
    - name: ghcr.io/loft-sh/vcluster:0.23.0-alpha.6
    - name: ghcr.io/loft-sh/vcluster-pro:0.23.0-alpha.6
    - name: dtzar/helm-kubectl:3
    - name: rancher/k3s:v1.28.15-k3s1
    - name: library/alpine:3.13.1
    - name: quay.io/jetstack/cert-manager-cainjector:v1.17.0
    - name: quay.io/jetstack/cert-manager-controller:v1.17.0
    - name: quay.io/jetstack/cert-manager-webhook:v1.17.0
    - name: quay.io/jetstack/cert-manager-startupapicheck:v1.17.0
    - name: rancher/backup-restore-operator:v6.0.0
    - name: rancher/calico-cni:v3.29.0-rancher1
    - name: rancher/cis-operator:v1.3.5
    - name: rancher/flannel-cni:v1.4.1-rancher1
    - name: rancher/fleet-agent:v0.11.3
    - name: rancher/fleet:v0.11.3
    - name: rancher/hardened-addon-resizer:1.8.20-build20241001
    - name: rancher/hardened-calico:v3.29.1-build20241211
    - name: rancher/hardened-cluster-autoscaler:v1.9.0-build20241126
    - name: rancher/hardened-cni-plugins:v1.6.0-build20241022
    - name: rancher/hardened-coredns:v1.12.0-build20241126
    - name: rancher/hardened-dns-node-cache:1.24.0-build20241211
    - name: rancher/hardened-etcd:v3.5.16-k3s1-build20241106
    - name: rancher/hardened-flannel:v0.26.1-build20241211
    - name: rancher/hardened-k8s-metrics-server:v0.7.1-build20241008
    - name: rancher/hardened-kubernetes:v1.31.4-rke2r1-build20241212
    - name: rancher/hardened-multus-cni:v4.1.3-build20241028
    - name: rancher/hardened-whereabouts:v0.8.0-build20241011
    - name: rancher/k3s-upgrade:v1.31.4-k3s1
    - name: rancher/klipper-helm:v0.9.3-build20241008
    - name: rancher/klipper-lb:v0.4.9
    - name: rancher/kube-api-auth:v0.2.3
    - name: rancher/kubectl:v1.31.1
    - name: rancher/local-path-provisioner:v0.0.30
    - name: rancher/machine:v0.15.0-rancher125
    - name: rancher/mirrored-cluster-api-controller:v1.8.3
    - name: rancher/nginx-ingress-controller:v1.10.5-hardened6
    - name: rancher/prometheus-federator:v0.4.4
    - name: rancher/pushprox-client:v0.1.4-rancher2-client
    - name: rancher/pushprox-proxy:v0.1.4-rancher2-proxy
    - name: rancher/rancher-agent:v2.10.2
    - name: rancher/rancher-csp-adapter:v5.0.1
    - name: rancher/rancher:v2.10.2
    - name: rancher/rancher-webhook:v0.6.3
    - name: rancher/rke2-cloud-provider:v1.31.2-0.20241016053446-0955fa330f90-build20241016
    - name: rancher/rke2-runtime:v1.31.4-rke2r1
    - name: rancher/rke2-upgrade:v1.31.4-rke2r1
    - name: rancher/rke-tools:v0.1.108
    - name: rancher/security-scan:v0.5.3
    - name: rancher/shell:v0.3.0
    - name: rancher/system-agent-installer-k3s:v1.31.4-k3s1
    - name: rancher/system-agent-installer-rke2:v1.31.4-rke2r1
    - name: rancher/system-agent:v0.3.11-suc
    - name: rancher/system-upgrade-controller:v0.14.2
    - name: rancher/ui-plugin-catalog:3.3.0
---
apiVersion: content.hauler.cattle.io/v1alpha1
kind: Charts
metadata:
  name: rancher-charts
spec:
  charts:
    - name: vcluster
      repoURL: https://charts.loft.sh
      version: v0.19.0
    - name: rancher
      repoURL: https://releases.rancher.com/server-charts/latest
      version: v2.10.2
    - name: cert-manager
      repoURL: https://charts.jetstack.io
      version: v1.17.0

---
apiVersion: content.hauler.cattle.io/v1alpha1
kind: Files
metadata:
  name: rancher-files
spec:
  files:
    - path: https://raw.githubusercontent.com/harvester/experimental-addons/main/rancher-vcluster/rancher-vcluster.yaml

This is cool to see!
Thanks for sharing!