• Suse Rancher 2.5.9
• Air-gapped environment
• 1 or more RKE downstream clusters
• RKE template configured for the downstream clusters

The provisioning of an RKE downstream cluster fails after adding extra_args for the kubelet service to a new RKE template and using this newly created template to provision the RKE cluster.

Error message while creating a new RKE cluster from the new RKE Template:
Unable to validate S3 backup target configuration: Get http://169.254.169.254/latest/meta-data/iam/security-credentials/": dial tcp 169.254.169.254:80: i/o timeout

Configuration:

E.g. extra_args for the kubelet added to the RKE Template:

    kubelet:
      ...
      extra_args:
        ...
        image-gc-high-threshold: '80'
        image-gc-low-threshold: '75'

• Check in the RKE Template if there is any setting set as a configurable question for the end-user
  • Go to Cluster Management => RKE1 Configuration => RKE Templates 
  • Select your desired RKE Template, and click on the 3-dot menu far on the right menu, select "Clone revision"  
  • Go to the "Cluster Option Overrides" section lower down on the cloned template, and uncheck any available options. After removing these configurable questions,  the value set in the template is used without user entry.
  • Set a Name for the new Template and click on Save. Select the newly created template and set it as Default Template if this is going to be your default template.