Seeking to help to silently deploy Rancher via MDM

[TechyTroublez]

Basically a copy of the question here #2090

I have been looking into a way to silently allow the Administrative Access Required option "Sudo" each time Rancher runs for our devs as they want to use this setting and I would rather automate this than have our 1st line manually set it up.

Has there been any change on how we could do this with newer versions of Rancher, I can't find a way as of yet via a profile etc.

[jandubois]

The only way to do this is by enabling password-less sudo, e.g. with

$ cat /etc/sudoers.d/nopasswd
%admin ALL=(ALL) NOPASSWD:ALL

The "privileged helper process" sadly remains unimplemented, so you somehow need to be able run something as root.

I'll see if I can come up with a script to make the changes that Rancher Desktop would make using sudo "manually", so you could run them via MDM and the dialog should not be displayed unless the network configuration of the machine changes.

[jandubois]

Ok here is a script that you can run as root after a reboot, and Rancher Desktop should not ask for a password even when Administrative Access is enabled. I've tested it with (you need to provide the name of the user to the script):

$ sudo rm -rf /opt/rancher-desktop /var/run/docker.sock /etc/sudoers.d/zzzz*
$ sudo ./admin-setup jan

And this is the script:

#!/bin/sh

USER=$1
if [ "$USER" = "" ]; then
    echo "Usage: $0 USER"
    exit 1
fi
if [ "$USER" = "root" ]; then
    echo "Rancher Desktop can not run as root"
    exit 1
fi
if ! [ -d "/Users/$USER" ]; then
    echo "Home directory /Users/$USER does not exist"
    exit 1
fi

set -o errexit -o nounset -o pipefail -o xtrace

# Create /var/run/docker.sock symlink; /var/run is deleted on each boot
ln -sf "/Users/${USER}/.rd/docker.sock" /var/run/docker.sock

LIMA_DIR="/Applications/Rancher Desktop.app/Contents/Resources/resources/darwin/lima"
LIMACTL="$LIMA_DIR/bin/limactl"

# Install socket_vmnet into protected location; must only be writable by root
mkdir -p /opt/rancher-desktop/bin
cp "$LIMA_DIR/socket_vmnet/bin/socket_vmnet" /opt/rancher-desktop/bin/

# Create networks.yaml that needs to **exactly** match the one Rancher Desktop would create
export LIMA_HOME="${TMPDIR:-/tmp}/.lima"
mkdir -p "$LIMA_HOME/_config"
cat <<EOF >"$LIMA_HOME/_config/networks.yaml"
paths:
  socketVMNet: /opt/rancher-desktop/bin/socket_vmnet
  varRun: /private/var/run
  sudoers: /private/etc/sudoers.d/zzzzz-rancher-desktop-lima
group: everyone
networks:
  rancher-desktop-shared:
    mode: shared
    gateway: 192.168.205.1
    dhcpEnd: 192.168.205.254
    netmask: 255.255.255.0
  host:
    mode: host
    gateway: 192.168.206.1
    dhcpEnd: 192.168.206.254
    netmask: 255.255.255.0
EOF

INTERFACES=$(/usr/sbin/system_profiler SPNetworkDataType -json -detailLevel basic \
           | awk '/interface/ {print $3}' \
           | tr -d '",')

for interface in $INTERFACES; do
    cat <<EOF >>"$LIMA_HOME/_config/networks.yaml"
  rancher-desktop-bridged_${interface}:
    mode: bridged
    interface: ${interface}
EOF
done

# Create sudoers file corresponding to networks.yaml
sudo -u "$USER" LIMA_HOME="$LIMA_HOME" "$LIMACTL" sudoers >/private/etc/sudoers.d/zzzzz-rancher-desktop-lima

Just make sure that it is executed after each reboot because /var/run is deleted by macOS on boot, so the symlink will always need to be re-created.

Enabling admin access by default can be done with deployment profiles.

Please let me know if this worked for you!

[TechyTroublez]

Thanks for all of your help @jandubois

I will run some testing with your suggestions, I did look at the idea of something like this but I tend to avoid adding entries into the sudoers file really - I know it serves a purpose for edge cases like this but yeah it may be the option.

$ cat /etc/sudoers.d/nopasswd
%admin ALL=(ALL) NOPASSWD:ALL

Do you have an example idea for the profile, I would use a profile as this is something I prefer to use when configuring preferences for an application where possible.

I have a template I put together.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>version</key>
  <integer>10</integer>
  <key>containerEngine</key>
  <dict>
    <key>allowedImages</key>
    <dict>
      <key>enabled</key>
      <true/>
    </dict>
  </dict>
</dict>
</plist>

Thanks

[jandubois]

I tend to avoid adding entries into the sudoers file

Note that when you allow "Administrative Access" then Rancher Desktop will create the sudoers file as well. It is needed for Lima to be able to start/stop the daemon that must run as root to be able to use Apple's VMNET framework.

The script I provided above essentially just does the same things Rancher Desktop would do internally. When it detects that all required changes are already in place, then it won't show the dialog because it doesn't have to make any modifications.

Anyways, I share your concerns about sudoers files, which is why I would like to have a privileged helper process, but we have too many other things to work on, so never got around to it.

[jandubois]

I have a template I put together.

That template will enabled the "Allowed Images" feature, but then has an empty list, so it will not allow you to pull any images, which is probably not what you want.

The easiest way to create a deployment profile is to configure Rancher Desktop with all the changes you want, and then run

rdctl create-profile --from-settings --output plist >deployment.plist

If this is a locked profile, then use an editor to remove all the settings you don't want to lock.