Cannot start the rke2-server.service at first control-plain during upgrade to v1.25.7+rke2r1

[vc43]

Environmental Info:
RKE2 Version:
v1.24.13+rke2r1

Node(s) CPU architecture, OS, and Version:
Linux 3.10.0-1160.83.1.el7.x86_64

Cluster Configuration:
3 servers, 7 agents

Describe the bug:
Launched upgrade from v1.24.13+rke2r1 to v1.25.7+rke2r1 via rancher 2.7.3 GUI and got stuck on updating the first server. There are errors on this server:

systemd[1]: Starting Rancher Kubernetes Engine v2 (server)...
sh[2593977]: + /usr/bin/systemctl is-enabled --quiet nm-cloud-setup.service
sh[2593977]: Failed to get unit file state for nm-cloud-setup.service: No such file or directory
rke2[2593984]: time="2023-05-17T12:31:25+03:00" level=fatal msg="missing required: user: unknown user etcd\nmissing required: group: unknown group etcd\n"
systemd[1]: rke2-server.service: main process exited, code=exited, status=1/FAILURE
systemd[1]: Failed to start Rancher Kubernetes Engine v2 (server).
systemd[1]: Unit rke2-server.service entered failed state.
systemd[1]: rke2-server.service failed.
systemd[1]: Stopped Rancher Kubernetes Engine v2 (server).

Steps To Reproduce:
Install rke2 v1.24.13+rke2r1 with air-gap install and private docker-registry.
Install rancher 2.7.3 and upgrade the local cluster from v1.24.13+rke2r1 to v1.25.7+rke2r1

• Installed RKE2:

token: mytoken
disable:
  - rke2-ingress-nginx
tls-san:
  - my.domain
node-taint:
  - node-role.kubernetes.io/controlplane=true:NoSchedule
  - node-role.kubernetes.io/etcd=true:NoExecute
profile: "cis-1.23"

[vc43]

I think that problem in option profile: "cis-1.23". Without it the process went further, but requires images v1.25.7+rke2r1.
It's not very clear how to get images during air-gap upgrade.

[brandond]

rke2[2593984]: time="2023-05-17T12:31:25+03:00" level=fatal msg="missing required: user: unknown user etcd\nmissing required: group: unknown group etcd\n"

CIS profiles would never have worked without the etcd users and groups present. Are you sure you didn't add this option when upgrading?

It's not very clear how to get images during air-gap upgrade.

You need to make the updated images available prior to upgrading; either by placing the tarball in the images dir on each node, or by loading them into your private registry if using one. Using a private registry as a mirror for docker.io is the preferred option.

[vc43]

CIS profiles would never have worked without the etcd users and groups present. Are you sure you didn't add this option when upgrading?

I followed this instruction: https://docs.rke2.io/known_issues#hardened-125
Initially, there was no option profile, everything worked well. Then I added the option and started the upgrade.
I have not done only Pod Security levels.

Now I have downloaded the necessary images, removed profile (whith profile logs as in the first message) and it works. Please explain in which cases this instruction is needed https://docs.rke2.io/known_issues#hardened-125