Document and add validation on enable_cri_dockerd option

docs/resources/cluster.md

@@ -95,7 +95,7 @@ The following arguments are supported:
 * `dind_storage_driver` - (Optional/Experimental) DinD RKE cluster storage driver (string)
 * `dind_dns_server` - (Optional/Experimental) DinD RKE cluster dns (string)
 * `dns` - (Optional) RKE k8s cluster DNS Config (list maxitems:1)
-* `enable_cri_dockerd` - (Optional) Enable/Disable CRI dockerd for kubelet. Default `false` (bool)
+* `enable_cri_dockerd` - (Optional) Enable/Disable CRI dockerd for kubelet; set it to true starting from Kubernetes version 1.24 or later. Default `false` (bool)
 * `ignore_docker_version` - (Optional) Enable/Disable RKE k8s cluster strict docker version checking. Default `false` (bool)
 * `ingress` - (Optional) RKE k8s cluster ingress controller configuration (list maxitems:1)
 * `kubernetes_version` - (Optional) K8s version to deploy. If kubernetes image is specified, image version takes precedence. Default: `rke default` (string)

rke/structure_rke_cluster.go

@@ -1,15 +1,22 @@
 package rke
 
 import (
+	"context"
 	"fmt"
+	"sort"
+	"strings"
 
+	"github.com/hashicorp/go-version"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/rancher/rke/cluster"
+	"github.com/rancher/rke/metadata"
 	rancher "github.com/rancher/rke/types"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	apiserverconfigv1 "k8s.io/apiserver/pkg/apis/config/v1"
 )
 
+const latestK8sMinorThatWorksWithoutCri = "1.23."
+
 // Flatteners
 
 func flattenRKEClusterFlag(d *schema.ResourceData, in *cluster.ExternalFlags) {
@@ -371,6 +378,10 @@ func expandRKECluster(in *schema.ResourceData) (string, *rancher.RancherKubernet
 		obj.Services.Kubeproxy.ExtraArgs["conntrack-max-per-core"] = "0"
 	}
 
+	if k8sVersionRequiresCri(obj.Version) && obj.EnableCRIDockerd != nil && !*obj.EnableCRIDockerd {
+		return "", nil, fmt.Errorf("kubernetes version %s requires enable_cri_dockerd to be set to true", obj.Version)
+	}
+
 	objYml, err := patchRKEClusterYaml(obj)
 	if err != nil {
 		return "", nil, fmt.Errorf("Failed to patch RKE cluster yaml: %v", err)
@@ -505,3 +516,26 @@ func expandRKEClusterFlag(in *schema.ResourceData, clusterFilePath string) clust
 
 	return obj
 }
+
+func k8sVersionRequiresCri(kubernetesVersion string) bool {
+	metadata.InitMetadata(context.Background())
+	// Get data from RKE package, change it to a slice so we can sort it.
+	versions := make([]*version.Version, 0, len(metadata.K8sVersionToRKESystemImages))
+	for k := range metadata.K8sVersionToRKESystemImages {
+		v, _ := version.NewVersion(k)
+		versions = append(versions, v)
+	}
+	sort.Sort(sort.Reverse(version.Collection(versions)))
+	// Removes the "v" from the version, so it matches the rke versions
+	kubernetesVersion = kubernetesVersion[1:]
+	// Go through the newer versions, stopping on 1.23.x
+	for _, v := range versions {
+		if strings.Contains(v.String(), latestK8sMinorThatWorksWithoutCri) {
+			break
+		}
+		if v.String() == kubernetesVersion {
+			return true
+		}
+	}
+	return false
+}

rke/structure_rke_cluster_test.go

@@ -0,0 +1,71 @@
+package rke
+
+import "testing"
+
+func Test_k8sVersionRequiresCri(t *testing.T) {
+	type args struct {
+		kubernetesVersion string
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "v1.26.4-rancher2-1",
+			args: args{
+				kubernetesVersion: "v1.26.4-rancher2-1",
+			},
+			want: true,
+		},
+		{
+			name: "v1.25.9-rancher2-2",
+			args: args{
+				kubernetesVersion: "v1.25.9-rancher2-2",
+			},
+			want: true,
+		},
+		{
+			name: "v1.24.13-rancher2-2",
+			args: args{
+				kubernetesVersion: "v1.24.13-rancher2-2",
+			},
+			want: true,
+		},
+		{
+			name: "v1.23.16-rancher2-3",
+			args: args{
+				kubernetesVersion: "v1.23.16-rancher2-3",
+			},
+			want: false,
+		},
+		{
+			name: "v1.22.17-rancher1-2",
+			args: args{
+				kubernetesVersion: "v1.22.17-rancher1-2",
+			},
+			want: false,
+		},
+		{
+			name: "v1.21.14-rancher1-1",
+			args: args{
+				kubernetesVersion: "v1.21.14-rancher1-1",
+			},
+			want: false,
+		},
+		{
+			name: "v1.20.15-rancher2-2",
+			args: args{
+				kubernetesVersion: "v1.20.15-rancher2-2",
+			},
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := k8sVersionRequiresCri(tt.args.kubernetesVersion); got != tt.want {
+				t.Errorf("k8sVersionRequiresCri() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}