Make RKE2 scripts pass shellcheck (severity=warning) and hygiene hooks

The lint CI runs pre-commit on changed files, so touching these scripts
surfaced pre-existing warnings. Address them without changing behavior:
- Quote array elements (SC2206) and command substitutions (SC2046).
- Disable SC2087 on the ssh heredocs (vars are intentionally expanded
  client-side) and SC1090 on 'source ~/.bashrc' (not followable).
- Keep unused config knobs (KVVERSION, interface) with a targeted
  SC2034 disable; drop the genuinely-unused allnomaster1 array.
- Strip trailing whitespace.

Verified: shellcheck --severity=warning clean and pre-commit green
(ShellCheck v0.10.0) on both files; bash -n syntax OK.

Kubernetes/RKE2-Cilium/rke2.sh

@@ -21,6 +21,7 @@ echo -e " \033[32;5m                                                           \
 #############################################
 
 # Version of Kube-VIP to deploy
+# shellcheck disable=SC2034  # kept as a documented config knob; not referenced in this script
 KVVERSION="v0.6.3"
 
 # Set the IP addresses of the admin, masters, and workers nodes
@@ -35,25 +36,23 @@ worker2=192.168.3.25
 user=ubuntu
 
 # Interface used on remotes
+# shellcheck disable=SC2034  # kept as a documented config knob; not referenced in this script
 interface=eth0
 
 # Set the virtual IP address (VIP)
 vip=192.168.3.50
 
 # Array of all master nodes
-allmasters=($master1 $master2 $master3)
+allmasters=("$master1" "$master2" "$master3")
 
 # Array of master nodes
-masters=($master2 $master3)
+masters=("$master2" "$master3")
 
 # Array of worker nodes
-workers=($worker1 $worker2)
+workers=("$worker1" "$worker2")
 
 # Array of all
-all=($master1 $master2 $master3 $worker1 $worker2)
+all=("$master1" "$master2" "$master3" "$worker1" "$worker2")
-
-# Array of all minus master1
-allnomaster1=($master2 $master3 $worker1 $worker2)
 
 #Loadbalancer IP range - this is set to /27 in rke2-cilium-config.yaml
 lbrange=192.168.3.64
@@ -115,7 +114,9 @@ echo "disable-kube-proxy: \"true\"" >> config.yaml
 sudo cp ~/config.yaml /etc/rancher/rke2/config.yaml
 
 # update path with rke2-binaries
-echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml' >> ~/.bashrc ; echo 'export PATH=${PATH}:/var/lib/rancher/rke2/bin' >> ~/.bashrc ; echo 'alias k=kubectl' >> ~/.bashrc ; source ~/.bashrc ;
+echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml' >> ~/.bashrc ; echo 'export PATH=${PATH}:/var/lib/rancher/rke2/bin' >> ~/.bashrc ; echo 'alias k=kubectl' >> ~/.bashrc
+# shellcheck disable=SC1090  # sourcing the user's ~/.bashrc, which shellcheck can't follow
+source ~/.bashrc
 
 # Step 2: Copy kube-vip.yaml and certs to all masters
 for newnode in "${allmasters[@]}"; do
@@ -125,6 +126,7 @@ for newnode in "${allmasters[@]}"; do
 done
 
 # Step 3: Connect to Master1 and move kube-vip.yaml and config.yaml. Then install RKE2, copy token back to admin machine. We then use the token to bootstrap additional masternodes
+# shellcheck disable=SC2087  # heredoc vars are intentionally expanded client-side before being sent to the remote root shell
 ssh -tt $user@$master1 -i ~/.ssh/$certName sudo su <<EOF
 mkdir -p /var/lib/rancher/rke2/server/manifests
 mkdir -p /etc/rancher/rke2
@@ -149,13 +151,14 @@ echo -e " \033[32;5mMaster1 Completed\033[0m"
 # Step 4: Set variable to the token we just extracted, set kube config location
 token=`cat token`
 sudo cat ~/.kube/rke2.yaml | sed 's/127.0.0.1/'$master1'/g' > $HOME/.kube/config
-sudo chown $(id -u):$(id -g) $HOME/.kube/config
+sudo chown "$(id -u):$(id -g)" $HOME/.kube/config
 export KUBECONFIG=${HOME}/.kube/config
 sudo cp ~/.kube/config /etc/rancher/rke2/rke2.yaml
 kubectl get nodes
 
 # Step 6: Add other Masternodes, note we import the token we extracted from step 3
 for newnode in "${masters[@]}"; do
+  # shellcheck disable=SC2087  # heredoc vars are intentionally expanded client-side before being sent to the remote root shell
   ssh -tt $user@$newnode -i ~/.ssh/$certName sudo su <<EOF
   mkdir -p /etc/rancher/rke2
   mkdir -p /var/lib/rancher/rke2/server/manifests
@@ -189,6 +192,7 @@ kubectl get nodes
 
 # Step 7: Add Workers
 for newnode in "${workers[@]}"; do
+  # shellcheck disable=SC2087  # heredoc vars are intentionally expanded client-side before being sent to the remote root shell
   ssh -tt $user@$newnode -i ~/.ssh/$certName sudo su <<EOF
   mkdir -p /etc/rancher/rke2
   touch /etc/rancher/rke2/config.yaml

Kubernetes/RKE2/rke2.sh

@@ -21,6 +21,7 @@ echo -e " \033[32;5m                                                           \
 #############################################
 
 # Version of Kube-VIP to deploy
+# shellcheck disable=SC2034  # kept as a documented config knob; not referenced in this script
 KVVERSION="v0.6.3"
 
 # Set the IP addresses of the admin, masters, and workers nodes
@@ -41,19 +42,16 @@ interface=eth0
 vip=192.168.3.50
 
 # Array of all master nodes
-allmasters=($master1 $master2 $master3)
+allmasters=("$master1" "$master2" "$master3")
 
 # Array of master nodes
-masters=($master2 $master3)
+masters=("$master2" "$master3")
 
 # Array of worker nodes
-workers=($worker1 $worker2)
+workers=("$worker1" "$worker2")
 
 # Array of all
-all=($master1 $master2 $master3 $worker1 $worker2)
+all=("$master1" "$master2" "$master3" "$worker1" "$worker2")
-
-# Array of all minus master1
-allnomaster1=($master2 $master3 $worker1 $worker2)
 
 #Loadbalancer IP range
 lbrange=192.168.3.60-192.168.3.80
@@ -123,7 +121,9 @@ echo "  - rke2-ingress-nginx" >> config.yaml
 sudo cp ~/config.yaml /etc/rancher/rke2/config.yaml
 
 # update path with rke2-binaries
-echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml' >> ~/.bashrc ; echo 'export PATH=${PATH}:/var/lib/rancher/rke2/bin' >> ~/.bashrc ; echo 'alias k=kubectl' >> ~/.bashrc ; source ~/.bashrc ;
+echo 'export KUBECONFIG=/etc/rancher/rke2/rke2.yaml' >> ~/.bashrc ; echo 'export PATH=${PATH}:/var/lib/rancher/rke2/bin' >> ~/.bashrc ; echo 'alias k=kubectl' >> ~/.bashrc
+# shellcheck disable=SC1090  # sourcing the user's ~/.bashrc, which shellcheck can't follow
+source ~/.bashrc
 
 # Step 2: Copy kube-vip.yaml and certs to all masters
 for newnode in "${allmasters[@]}"; do
@@ -134,6 +134,7 @@ for newnode in "${allmasters[@]}"; do
 done
 
 # Step 3: Connect to Master1 and move kube-vip.yaml and config.yaml. Then install RKE2, copy token back to admin machine. We then use the token to bootstrap additional masternodes
+# shellcheck disable=SC2087  # heredoc vars are intentionally expanded client-side before being sent to the remote root shell
 ssh -tt $user@$master1 -i ~/.ssh/$certName sudo su <<EOF
 mkdir -p /var/lib/rancher/rke2/server/manifests
 mv kube-vip.yaml /var/lib/rancher/rke2/server/manifests/kube-vip.yaml
@@ -154,7 +155,7 @@ echo -e " \033[32;5mMaster1 Completed\033[0m"
 # Step 4: Set variable to the token we just extracted, set kube config location
 token=`cat token`
 sudo cat ~/.kube/rke2.yaml | sed 's/127.0.0.1/'$master1'/g' > $HOME/.kube/config
-sudo chown $(id -u):$(id -g) $HOME/.kube/config
+sudo chown "$(id -u):$(id -g)" $HOME/.kube/config
 export KUBECONFIG=${HOME}/.kube/config
 sudo cp ~/.kube/config /etc/rancher/rke2/rke2.yaml
 kubectl get nodes
@@ -165,6 +166,7 @@ kubectl apply -f https://raw.githubusercontent.com/kube-vip/kube-vip-cloud-provi
 
 # Step 6: Add other Masternodes, note we import the token we extracted from step 3
 for newnode in "${masters[@]}"; do
+  # shellcheck disable=SC2087  # heredoc vars are intentionally expanded client-side before being sent to the remote root shell
   ssh -tt $user@$newnode -i ~/.ssh/$certName sudo su <<EOF
   mkdir -p /etc/rancher/rke2
   touch /etc/rancher/rke2/config.yaml
@@ -187,6 +189,7 @@ kubectl get nodes
 
 # Step 7: Add Workers
 for newnode in "${workers[@]}"; do
+  # shellcheck disable=SC2087  # heredoc vars are intentionally expanded client-side before being sent to the remote root shell
   ssh -tt $user@$newnode -i ~/.ssh/$certName sudo su <<EOF
   mkdir -p /etc/rancher/rke2
   touch /etc/rancher/rke2/config.yaml